This article covers the week prior’s vulnerabilities found to be actively exploited. They are categorised based not only on the category of exploitation, but their impact, and versions affected. This article also informs on any official fix and remediation guidance for the listed vulnerabilities.

CVE-2024-27198

Category: Authentication & Session Management

Versions Affected:

All JetBrains TeamCity On-Premises installations through version 2023.11.3.

Vulnerability Summary:

In JetBrains TeamCity before 2023.11.4 it is possible for threat actors to circumvent the authentication mechanism by sending a crafted request to the web server and gain access to a privileged (administrative) context. The vulnerability bears a strong resemblance to an earlier critical flaw uncovered in TeamCity a few months prior (CVE-2023-42793) but is unrelated.

The security vulnerability exists in the jetbrains.buildServer.controllers.BaseController class of the web-openapi.jar library. The method getJspFromRequest allows an attacker to access an arbitrary endpoint by manipulating the jsp to REST API requests – setting the jsp query parameter in the request to the desired path which requires authentication. For example, an attacker who wanted to access the /app/rest/server endpoint could instead call the REST API without authentiation and pass in the requested path as a query parameter ?jsp=/app/rest/server. The example request would look like, http://sw-test.local:8111/sw?jsp=/app/rest/server?.jsp.

Official Fix & Remediation Guidance:

The main solution is to urgently update impacted TeamCity instances to the new patched version that fixes this vulnerability: Version 2023.11.4. Customers are advised to upgrade to the fixed version (either manually or by using the automatic update option within the solution). To update your server, download the latest version (2023.11.4) or use the automatic update option within TeamCity.

If customers are unable to update servers to version 2023.11.4 immediately, apply the security patch plugin 2024_02.

TeamCity advise that if an impacted server is publicly accessible over the internet, and you are unable to immediately perform remediation, it is strongly recommend making your server inaccessible from the public internet.

NOTE: Remediation of this vulnerability by patching to a specific version indicated may not be sufficient to secure the product against further vulnerabilities discovered in later versions, subsequent to the publication of this guidance. Unless contra-indicated, customers are therefore advised to always upgrade to the latest version of the product available.

About AppCheck

AppCheck is a software security vendor based in the UK, offering a leading security scanning platform that automates the discovery of security flaws within organisations websites, applications, network, and cloud infrastructure. AppCheck are authorized by the Common Vulnerabilities and Exposures (CVE) Program as a CVE Numbering Authority (CNA).