JetBrains TeamCity Authentication Bypass and Remote Code Execution (RCE) Vulnerability (CVE-2023-42793) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTAll on-premises versions of JetBrains TeamCity prior to 2023.05.4
Unauthenticated attackers can bypass authentication, gain administrative privileges, hijack build pipelines, and execute arbitrary code on the server
Immediately upgrade TeamCity server to version 2023.05.4 or later, or apply the official security patch plugin
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade the TeamCity server to version 2023.05.4 or later. For Docker-based deployments, use the following commands to update your container:
# 1. Stop and remove the vulnerable TeamCity container
docker stop teamcity-server
docker rm teamcity-server
# 2. Pull the patched version image (2023.05.4 or later)
docker pull jetbrains/teamcity-server:2023.05.4
# 3. Start the container with existing data volumes
docker run -d --name teamcity-server \
-v /opt/teamcity_server/datadir:/data/teamcity_http_settings \
-v /opt/teamcity_server/logs:/opt/teamcity/logs \
-p 8111:8111 \
jetbrains/teamcity-server:2023.05.42. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, apply the official security patch plugin provided by JetBrains, or restrict access to the vulnerable REST API endpoints using a reverse proxy like Nginx.
# Nginx configuration to block external access to vulnerable REST API endpoints
server {
listen 80;
server_name teamcity.internal.local;
location / {
proxy_pass http://localhost:8111;
}
# Block external access to vulnerable token and user endpoints
location ~* /app/rest/(users|tokens) {
allow 127.0.0.1;
allow 10.0.0.0/8; # Allow trusted internal network only
deny all;
proxy_pass http://localhost:8111;
}
}3. Log Audit & IoC Verification Commands
Run the following Bash script on your TeamCity server host to inspect access logs for potential exploitation attempts.
#!/bin/bash
LOG_DIR='/opt/teamcity_server/logs'
echo '[*] Scanning TeamCity logs for CVE-2023-42793 indicators of compromise...'
# Search for unauthorized token generation requests in the logs
if [ -d '$LOG_DIR' ]; then
grep -rnI '/app/rest/users/id:1/tokens' '$LOG_DIR' && echo '[!] WARNING: Potential exploitation attempt detected!' || echo '[+] No obvious indicators found.'
else
echo '[-] Log directory not found. Verify the path.'
fiScan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-42793) is a critical authentication bypass flaw residing in the request handling pipeline of JetBrains TeamCity. The root cause stems from a design flaw (CWE-288, CWE-306) where specific REST API endpoints (such as '/app/rest/users/id:1/tokens/RPC2') bypass the security interceptors and servlet filters responsible for authentication. This allows unauthenticated remote attackers to perform administrative actions without valid credentials.
2. Exploitation Mechanics & Attack Scenario
An attacker exploits this vulnerability by sending a specially crafted HTTP POST request to the vulnerable REST API endpoints. Because the authentication filter is bypassed, the server processes the request as if it were authorized, allowing the attacker to generate a high-privilege API access token for the primary administrator account (typically user ID 1). With this token, the attacker gains full administrative access, enabling them to modify build configurations, inject malicious scripts, or execute arbitrary OS commands on the host server and connected build agents.
3. Infrastructure & Business Impact
As TeamCity acts as the central orchestrator for software build and deployment pipelines, compromise of this server has catastrophic consequences. Attackers can steal sensitive assets, including source code repositories, cloud infrastructure credentials, and code-signing certificates. Furthermore, this can lead to supply chain attacks where malicious code is injected into production software builds, impacting downstream customers. Given its active exploitation in the wild (CISA KEV listed, EPSS 0.9999), immediate remediation is critical.
Official Vendor Advisories & References
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
Frequently Asked SecOps Questions (CVE-2023-42793)
FAQQ1. How critical is CVE-2023-42793 and is it actively exploited in the wild?
CVE-2023-42793 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-42793?
Primary impacted vendors include jetbrains across teamcity. Scope summary: All on-premises versions of JetBrains TeamCity prior to 2023.05.4 (TeamCity Cloud is not affected)
Q3. What temporary mitigations or workarounds exist for CVE-2023-42793 before patching?
[Mitigation] Immediately upgrade TeamCity server to version 2023.05.4 or later, or apply the official security patch plugin Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-42793
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (jetbrains)
View Category →JetBrains TeamCity Unauthenticated Remote Code Execution Vulnerability via Agent Polling Protocol (CVE-2026-63077)
[Affected Scope] JetBrains TeamCity versions prior to 2026.1.3 and 2025.11.7
marimo Reactive Python Notebook Pre-Auth Remote Code Execution (RCE) via Terminal WebSocket Authentication Bypass (CVE-2026-39987)
[Affected Scope] All versions of marimo open-source Python notebook prior to 0.23.0
Ivanti Endpoint Manager (EPM) Authentication Bypass and Credential Leak Vulnerability (CVE-2026-1603) Urgent Security Advisory
[Affected Scope] Ivanti Endpoint Manager (EPM) versions prior to 2024 SU5
GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.