CVE-2023-42793

What it actually does

This vulnerability is an unauthenticated authentication bypass in JetBrains TeamCity Server versions before 2023.05.4 that allows a remote attacker to access privileged REST API functionality without valid credentials. In practical exploitation, attackers can create or abuse administrative access tokens, create administrator accounts, and then use TeamCity’s administrative capabilities to execute code through build configurations, plugins, scripts, or agent/server-side automation. Because TeamCity commonly stores source-control credentials, build secrets, signing keys, deployment tokens, and CI/CD pipeline definitions, successful exploitation can lead to full server compromise, credential theft, build pipeline manipulation, and downstream software supply-chain impact.

Why it matters to the business

Compromise of a TeamCity server can disrupt software delivery, expose source code and secrets, allow tampering with builds or releases, and provide attackers a foothold into connected development, cloud, and deployment environments. This issue is known to be exploited in the wild, is listed in CISA KEV, has been associated with ransomware activity, and has an extremely high EPSS score, so internet-exposed TeamCity servers should be treated as high-priority incident-response targets, not merely routine patching tasks.

How an attack unfolds

An attacker scans for exposed TeamCity servers and sends crafted unauthenticated HTTP requests to vulnerable REST API endpoints that should require authentication. The attacker can create an access token for an existing privileged user or create a new administrative user, then authenticates using that token or account. With administrative access, the attacker can inspect projects, retrieve secrets, modify build steps, upload plugins, configure command-line runners, or trigger builds that execute attacker-controlled commands. Post-exploitation activity commonly includes persistence through newly created users or tokens, theft of CI/CD secrets and source-control credentials, deployment of malware or remote-access tooling, lateral movement into connected systems, cleanup of temporary tokens or accounts, and, in some campaigns, ransomware deployment or software supply-chain tampering.

How to fix it

Upgrade JetBrains TeamCity Server to version 2023.05.4 or later immediately; preferably upgrade to the latest supported TeamCity release. If immediate upgrade is not possible, apply JetBrains’ official security patch plugin for affected versions as a temporary mitigation, then schedule a full upgrade as soon as possible. Restrict TeamCity access to trusted networks or VPN, remove direct internet exposure, and enforce SSO/MFA where available. After patching, assume exposed vulnerable servers may have been compromised: revoke suspicious access tokens, rotate TeamCity admin credentials, rotate VCS credentials, deployment keys, cloud secrets, signing keys, artifact repository credentials, and any secrets stored in build parameters or connected integrations. Review and remove unauthorized users, tokens, plugins, build steps, runners, webhooks, agent registrations, and scheduled triggers. Rebuild the server from trusted media if compromise is confirmed or cannot be ruled out.

How to confirm the fix worked

Confirm the running TeamCity Server version is 2023.05.4 or later, or that the official JetBrains mitigation plugin is installed only as a temporary control. Verify unauthenticated requests to sensitive REST API endpoints such as token creation, user creation, role assignment, server administration, and debug/process endpoints return 401/403 and do not create users, tokens, or server-side actions. Review the TeamCity Administration UI, REST API, and audit logs for unauthorized users, administrator role assignments, tokens, plugins, build configuration changes, and agent changes. Validate network controls by confirming the TeamCity web interface is not reachable from untrusted networks. Finally, rotate secrets and confirm old credentials and tokens no longer work against source control, cloud, artifact, package, and deployment systems.

Typical attack path

1. Identify an internet-facing JetBrains TeamCity Server instance.
2. Confirm the server is running a version before 2023.05.4 or test for the vulnerable unauthenticated REST behavior.
3. Send crafted unauthenticated requests to REST API token or user-management endpoints.
4. Create or obtain an administrative access token or create a new administrator account.
5. Use administrative access to inspect projects, build configurations, agents, secrets, and VCS integrations.
6. Execute code by modifying build steps, triggering command-line runners, abusing debug/process functionality, or uploading a malicious plugin.
7. Establish persistence through users, tokens, plugins, scheduled build steps, or external remote-access tooling.
8. Exfiltrate source code, credentials, signing material, build artifacts, or deployment secrets.
9. Move laterally into connected source-control, artifact, cloud, or deployment environments.
10. Optionally deploy malware, miners, backdoors, or ransomware and attempt to delete tokens, users, logs, or build history to hide activity.

How to detect it

Review TeamCity web access logs, reverse proxy logs, application logs, audit logs, build history, plugin directories, server filesystem changes, and endpoint telemetry from both the TeamCity server and connected build agents. Focus on the period before patching and any time the server was internet-accessible. Look for unauthenticated or unusual requests to REST API paths that create tokens, manage users, assign roles, upload plugins, trigger builds, or invoke process/debug functionality. In TeamCity audit data, investigate new administrator accounts, unexpected access tokens, deleted tokens, role changes to SYSTEM_ADMIN, plugin uploads, build configuration changes, new command-line build steps, unusual build triggers, and newly registered agents. In EDR or host logs, investigate TeamCity server or agent processes spawning shells, scripting engines, download utilities, archive tools, credential-dumping tools, miners, or remote-access tools. Because exploitation has been used in active campaigns including ransomware-related activity, also check connected source-control, artifact, cloud, and deployment systems for access using credentials stored in TeamCity after the suspected exploitation window.

• /app/rest/users/id:1/tokens/RPC2
• POST /app/rest/users/id:1/tokens/
• DELETE /app/rest/users/id:1/tokens/RPC2
• /app/rest/users
• /app/rest/users/username:
• /app/rest/users/id:
• /app/rest/users/*/roles
• SYSTEM_ADMIN
• /app/rest/debug/processes
• /app/rest/plugins
• /app/rest/buildQueue
• /app/rest/buildTypes
• /app/rest/server
• eyJ0eXAiOiAiVENWMiJ9
• krtbgt
• teamcity-server.log
• teamcity-activities.log
• teamcity-auth.log
• teamcity-vcs.log
• teamcity-rest.log
• TeamCity Data Directory/plugins
• TeamCity Data Directory/system/pluginData
• TeamCity Data Directory/config/projects
• cmd.exe spawned by TeamCity
• powershell.exe spawned by TeamCity
• bash spawned by TeamCity
• sh spawned by TeamCity
• curl spawned by TeamCity
• wget spawned by TeamCity
• certutil.exe spawned by TeamCity
• bitsadmin.exe spawned by TeamCity
• rundll32.exe spawned by TeamCity
• msiexec.exe spawned by TeamCity

What your security team should do

• Immediately inventory all JetBrains TeamCity Server instances, especially internet-facing systems.
• Patch or upgrade all affected TeamCity servers to 2023.05.4 or later; prioritize any externally reachable instance.
• If patching is delayed, apply JetBrains’ official mitigation plugin and restrict access to trusted IP ranges or VPN only.
• Treat vulnerable internet-exposed instances as potentially compromised and perform incident response review before returning them to normal operation.
• Search access logs for unauthenticated REST calls to token, user, role, plugin, debug, and process-related endpoints.
• Review TeamCity audit logs for new users, new tokens, administrator role changes, uploaded plugins, modified build steps, suspicious triggered builds, and deleted tokens.
• Rotate TeamCity administrator passwords, personal access tokens, VCS credentials, deployment keys, cloud credentials, signing keys, and secrets stored in build parameters.
• Inspect build agents for suspicious processes, persistence, unexpected tools, malware, or unauthorized new agent registrations.
• Remove unauthorized users, tokens, plugins, build runners, webhooks, triggers, SSH keys, and service connections.
• Add SIEM detections for vulnerable endpoint access, unexpected TeamCity child processes, admin-account creation, and TeamCity service activity spawning shells or download tools.