In this blog series, we look at a new CVE each month and discuss its impact, discovery, and remediation. This month we are diving into the JetBrains TeamCity vulnerabilities which will allow hackers to take control over CI/CD servers by bypassing authentication. We will discuss the technical details of the vulnerability and then dive into some discussion around the controversy of this disclosure (we will spill the CVE tea!)

JetBrains TeamCity

JetBrains TeamCity is a free CI/CD (continuous integration and Continuous Deployment) tool that is used by 30,000 DevOps teams and many more developers. This makes it a big target for attackers to conduct large-scale supply chain attacks which makes these vulnerabilities even more scary. The Russian-backed hacking group behind the 2020 SolarWinds attack was discovered to be actively attempting to exploit a similar but different vulnerability in Jetbrains TeamCity already back in 2023.

About the vulnerability

These vulnerabilities are both authentication bypasses, the most severe of the two enables an attacker to conduct a complete takeover of the TeamCity server allowing RCE to essentially grant full access to the projects, build process, and artifacts. 

How does the exploit work?

By default TeamCity creates a web server over HTTP at port 8111, an attacker can then create a URL that bypasses all the authentication checks which then allows endpoints to be accessible that were meant to be secured behind authentication. The main exploitation path would be for an attacker to leverage this vulnerability by creating a new administrator account including passwords controlled entirely by the unauthenticated attacker, The attacker can then log into the web portal or request an administrator token to take full control of the system.  Read a full technical analysis 

Versions affected 

Firstly, all cloud instances of TeamCity have been patched and only the on-prem versions are vulnerable from version 2023.11.3 it is CRITICAL that if you are using an on-prem version of TeamCity you update to at least 2023.11.4 released on March 4th, 2024 (Note, JetBrains have a very misleading versioning method). 

The Controversy 

If you thought the world of CVEs was boring, let me tell you there is enough drama it could be a new reality TV show on Netflix. 

This vulnerability was first discovered by the amazing research team at Rapid7 on February 19th who shared a detailed report to JetBrains. JetBrains then suggested a path in which they would follow to resolve this, including a blog post, email communication, and publishing the CVE records, but crucially, they would not release any of this until ‘a few days’ after the patch was released (which took multiple weeks). Rapid7 was adamantly against this as they believed it constituted ‘silent patching’, Rapid7 has a policy o release all information as soon as the patch is released. 

JetBrains stopped communicating with Rapid7 from February 23rd to March 1st. On March 4th they released the patch but DID NOT communicate about the security incident when they released the patch! Rapid7 however published full technical documentation of the security issue on the same day. 

Both parties have rationale behind their approach, JetBrains didn’t want to release information that would allow hackers to target systems before they had been patched. Rapid7 didn’t want to wait because people wouldn’t understand the urgency of patching. But here is the problem, the fact that both decided to adopt their own approach left TeamCity users in the most vulnerable position. The attackers had information from Rapid7, but the user had no information regarding the security of JetBrains. This likely affected the urgency in which they updated. This likely contributed to why we saw this vulnerability exploited in the wild so quickly. In the end, both company's approaches contributed to what they were trying to avoid.

*** This is a Security Bloggers Network syndicated blog from GitGuardian Blog - Code Security for the DevOps generation authored by Mackenzie Jackson. Read the original post at: https://blog.gitguardian.com/jetbrains-teamcity-cve-2024-27198/