- Buy Microsoft Visio Professional or Microsoft Project Professional 2024 for just $80
- Get Microsoft Office Pro and Windows 11 Pro for 87% off with this bundle
- Buy or gift a Babbel subscription for 78% off to learn a new language - new low price
- Join BJ's Wholesale Club for just $20 right now to save on holiday shopping
- This $28 'magic arm' makes taking pictures so much easier (and it's only $20 for Black Friday)
TeamCity Users Urged to Patch Critical Vulnerabilities
Software developer JetBrains has warned users of its popular TeamCity CI/CD tool that they should prioritize patching of two new vulnerabilities or risk compromise.
Discovered by Rapid7 last month, the bugs are listed as CVE-2024-27198 and CVE-2024-27199. The security vendor has now released exploit details, which makes patching more urgent.
The former is an authentication bypass vulnerability in the web component of TeamCity that arises from an alternative path issue (CWE-288) and has a CVSS base score of 9.8. The latter is an authentication bypass vulnerability in the web component of TeamCity that arises from a path traversal issue (CWE-22) and has a CVSS base score of 7.3.
“Both vulnerabilities are authentication bypass vulnerabilities, the most severe of which, CVE-2024-27198, allows for a complete compromise of a vulnerable TeamCity server by a remote unauthenticated attacker, including unauthenticated remote code execution (RCE),” said Rapid7 in a blog post.
“The second vulnerability, CVE-2024-27199, allows for a limited amount of information disclosure and a limited amount of system modification, including the ability for an unauthenticated attacker to replace the HTTPS certificate in a vulnerable TeamCity server with a certificate of the attacker’s choosing.”
Read more on TeamCity vulnerabilities: Patched Critical Flaw Exposed JetBrains TeamCity Servers
Rapid7 warned that compromising TeamCity servers would enable a threat actor to gain full remote control of projects, builds, agents and artifacts, putting them in a strong position to launch dangerous supply chain attacks.
JetBrains yesterday released a new version of the software, 2023.11.4, to fix the two vulnerabilities. It also published a security patch plugin so that customers who are unable to upgrade can still patch their environment.
“All versions of TeamCity On-Premises are affected by these vulnerabilities. Customers of TeamCity Cloud have already had their servers patched, and we have verified that they weren’t attacked,” the vendor said.
