JetBrains TeamCity Authentication Bypass Vulnerability (CVE-2023-42793)

What is affected, what to do

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update JetBrains TeamCity to version 2023.05.4. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• JetBrains TeamCity lt *..2023.05.4

Fixed in

• JetBrains TeamCity 2023.05.4

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade TeamCity Server to 2023.05.4 or later immediately. JetBrains additionally ships a Security Patch Plugin for older branches that cannot be upgraded quickly — download from the official JetBrains advisory and install via the admin console.
   • Until patched, remove the TeamCity web UI (default 8111/tcp, or 443/tcp on a fronting reverse proxy) from the internet; restrict access to a CI developer VLAN or VPN with an IP allowlist.
   • Run compromise triage: inspect <TeamCity Data Directory>/system/pluginData and <TeamCity Home>/webapps/ROOT/plugins/ for unknown JAR/ZIP plugins, review the admin user list for newly created accounts, and audit activity logs for suspicious calls against /app/rest/users.
   • Treat every secret stored in TeamCity as compromised and rotate it: SSH keys, service account tokens, Docker registry credentials, signing keys, cloud deployment credentials, connected-VCS tokens (GitHub/GitLab/Bitbucket PATs).
   • Isolate build agents and check for persistent payloads; if in doubt, reprovision agents from clean images rather than cleaning them in place — artifacts they produced are supply-chain-tainted.
   • Open an incident ticket with explicit supply-chain scope: flag every build artifact produced since at least September 2023 as potentially tampered and verify signatures/hashes against trusted references.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: place TeamCity Server in a dedicated management VLAN, allow inbound only from the CI developer subnet and build agents, and terminate any direct internet exposure at the WAF/reverse proxy.
   • WAF rule: block requests to /app/rest/users/id:1/tokens/RPC2 and more generally POSTs to /app/rest/users/*/tokens/* unless they carry a valid authenticated admin session cookie — this is the path abused by the public PoC to mint an admin token.
   • IAM hardening: run the TeamCity service account with minimal host privileges (no local admin, no domain admin, no production access) under a dedicated low-privilege user.
   • Egress filtering: restrict outbound traffic from the TeamCity server to an allowlist (internal artifact store, VCS, package registries); drop arbitrary outbound 443/tcp to unknown hosts and typical reverse-shell ports.
   • Secrets management: migrate TeamCity "password" parameters into an external vault (HashiCorp Vault, Azure Key Vault) with short-lived credentials, so a future server compromise yields less leverage.
   • Backup integrity: snapshot TeamCity configuration and project definitions before patching, so a confirmed compromise has a defined pre-breach baseline for forensics and rollback.
3. 03

   Runbook step 3

   Detection rules

   • Web access logs (reverse proxy or TeamCity logs/catalina.out): POST requests to /app/rest/users/id:1/tokens/* returning HTTP 200 without a preceding authenticated session — strongest single indicator of the auth bypass. KQL shape: WebLogs | where UriPath matches regex @"/app/rest/users/id:\d+/tokens/" and HttpMethod == "POST".
   • Short-interval creation of admin accounts or access tokens: parse TeamCity audit log (logs/teamcity-activities.log) for USER_CREATE, USER_ROLE_ADD with role SYSTEM_ADMIN, and TOKEN_CREATE outside approved change windows.
   • Sysmon EID 1 on the TeamCity host: parent java.exe/java (TeamCity JVM) spawning cmd.exe, powershell.exe, /bin/sh, bash, curl, wget, nc — the JVM should not spawn shell children.
   • File-system monitoring (auditd -w <TeamCity>/webapps/ROOT/plugins -p wa, or Sysmon EID 11): new JAR/ZIP files landing in plugin directories without a matching change ticket.
   • Network telemetry (Zeek/Suricata): outbound connections from the TeamCity host to IPs outside the allowlist, especially on 443/tcp, 4444/tcp, 8080/tcp, or DNS lookups against dynamic DNS providers. Sigma shape: category: proxy with src_ip: <teamcity> and dst_ip not in allowlist.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

Source: CSA/SingCERT, pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• JetBrains JetBrains TeamCity

Weakness classes (CWE)

• CWE-288Authentication Bypass Using an Alternate Path or Channel

  Base

  The product requires authentication, but the product has an alternate path or channel that does not require authentication.

  Entry at MITRE CWE-288

References & sources

• jetbrains.comprivacy-security/issues-fixedVendor advisory
• blog.jetbrains.comteamcity/2023/09/cve-2023-42793-vulnerability-post-mortemVendor advisory
• packetstormsecurity.comfiles/174860/JetBrains-TeamCity-Unauthenticated-Remote-Code-Exe…Exploit, Third-party advisory, Vulnerability database
• attackerkb.comtopics/1XEEEkGHzt/cve-2023-42793Third-party advisory
• securityweek.comrecently-patched-teamcity-vulnerability-exploited-to-hack-serve…Press coverage
• rapid7.comblog/post/2023/09/25/etr-cve-2023-42793-critical-authentication…Broken link, Third-party advisory
• sonarsource.comblog/teamcity-vulnerabilityExploit, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42793government-resource, US government resource
• pwn.watchpwn.watch: TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)pwn-watch
• blog.jetbrains.comCritical Security Issue Affecting TeamCity On-Premises – Update to 2023.05.4 Nowpwn-watch
• microsoft.comMultiple North Korean threat actors exploiting the TeamCity CVE-2023-42793 vulnerabilitypwn-watch
• cisa.govRussian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally (AA23-347A)pwn-watch
• NVD (NIST)NVD: CVE-2023-42793pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch