Security News > 2023 > September > Critical JetBrains TeamCity vulnerability could be exploited to launch supply chain attacks (CVE-2023-42793)

Software development firm JetBrains has fixed a critical vulnerability in its TeamCity continuous integration and continuous delivery solution, which may allow authenticated attackers to achieve remote code execution and gain control of the server.
"As of September 25, 2023, Rapid7 is not aware of in-the-wild exploitation of CVE-2023-42793, and no public exploit code is available," shared Caitlin Condon, head of vulnerability research at Rapid7.
CVE-2023-42793 is an authentication bypass vulnerability that affects versions 2023.05.3 and below of TeamCity On-Premises.
CVE-2023-42793 has been fixed in version 2023.05.4 of TeamCity On-Premises.
Users running TeamCity 2018.2 and later won't have to restart the server to enable the plugin once installed, but those running versions 8.0 to 2018.1 must perform a server restart.
"While we won't be disclosing technical details at this time, we want to emphasize the importance of prompt action to mitigate this risk. Because this vulnerability does not require a valid account on the target instance and is trivial to exploit, it is likely that this vulnerability will be exploited in the wild," Schiller commented, and noted that Shodan currently shows over 3,000 on-premises TeamCity servers accessible from the Internet.
News URL
https://www.helpnetsecurity.com/2023/09/26/cve-2023-42793/
Related news
- Coinbase Initially Targeted in GitHub Actions Supply Chain Attack; 218 Repositories' CI/CD Secrets Exposed (source)
- Critical Next.js Vulnerability Allows Attackers to Bypass Middleware Authorization Checks (source)
- ⚡ THN Weekly Recap: GitHub Supply Chain Attack, AI Malware, BYOVD Tactics, and More (source)
- Critical Next.js auth bypass vulnerability opens web apps to compromise (CVE-2025-29927) (source)
- Critical Ingress NGINX Controller Vulnerability Allows RCE Without Authentication (source)
- CrushFTP: Patch critical vulnerability ASAP! (CVE-2025-2825) (source)
- Mozilla Patches Critical Firefox Bug Similar to Chrome’s Recent Zero-Day Vulnerability (source)
- Critical auth bypass bug in CrushFTP now exploited in attacks (source)
- Recent GitHub supply chain attack traced to leaked SpotBugs token (source)
- SpotBugs Access Token Theft Identified as Root Cause of GitHub Supply Chain Attack (source)
Related Vulnerability
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2023-09-19 | CVE-2023-42793 | Missing Authentication for Critical Function vulnerability in Jetbrains Teamcity In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible | 9.8 |