TeamCity Auth Bypass & RCE (CVE-2023-42793 & CVE-2024-27198)

1. The Compromise of the Build Pipeline

JetBrains TeamCity is one of the most widely deployed Continuous Integration and Delivery (CI/CD) servers used by software development, fintech, and enterprise ecommerce organizations. In late 2023 and early 2024, security researchers identified two critical authentication bypass vulnerabilities: CVE-2023-42793 and CVE-2024-27198 (CVSS 9.8), which allowed unauthenticated remote attackers to generate permanent administrator accounts and execute arbitrary commands across all connected build agents.

2. CVE Metadata Overview

3. Technical Root Cause: Spring MVC Interceptor Path Traversal

TeamCity uses Spring MVC to route web traffic. To protect administrative endpoints, TeamCity implemented an interceptor filter that checked if the incoming URI started with /admin/.

In CVE-2023-42793, the /app/rest/users/id:1/tokens/RPC2 endpoint was accidentally mapped under the public path /res/. An unauthenticated attacker simply accessed the token creation endpoint without hitting the authentication interceptor:

POST /app/rest/users/id:1/tokens/RPC2 HTTP/1.1
Host: teamcity.enterprise.internal
Content-Type: text/plain

name=admin_token

The server created and returned a full Administrator REST API authentication token in plain text: eyJhbGciOiJIUzI1NiJ9....

With this token, an attacker connected to the TeamCity REST API, uploaded a rogue plugin (which executes raw Java bytecode on server startup), or triggered an automated build configuration that ran arbitrary bash scripts on all attached worker agents.

4. Detection and Remediation Protocol

# Search TeamCity access logs for unauthorized token generation
grep -E 'POST /app/rest/users/id:[0-9]+/tokens' /opt/teamcity/logs/teamcity-rest.log

# Audit active administrator tokens in the TeamCity database
# Navigate to Administration -> Users -> Super User -> Access Tokens

5. Remediation Steps

1. Upgrade TeamCity to version 2023.11.4 (or 2023.05.4) or later.
2. Rotate all cloud credentials, AWS IAM secret keys, and private SSH deployment keys stored as TeamCity project parameters.
3. Restrict TeamCity web interfaces to internal VPN subnets.