JetBrains TeamCity On-Premises CVE-2023-42793 (authentication bypass leading to remote code execution, exploited by ransomware and state actors, CISA KEV): which version fixes it and what if the server was exposed?

What it is: CVE-2023-42793 is an authentication bypass in TeamCity On-Premises that lets an unauthenticated attacker with HTTP(S) access take control of the CI/CD server, including remote code execution. JetBrains released a fix in September 2023 and it was exploited shortly after, including by ransomware groups and, according to a CISA advisory, by Russia's foreign intelligence service (SVR). It is in the CISA KEV catalog (added 2023-10-04). Because CI servers hold build secrets and signing access, a compromise can reach software supply chains. Am I affected: - TeamCity On-Premises before 2023.05.4. TeamCity Cloud was not affected. - Check the version shown in the web UI (Administration area) or the footer. Fix: 1. Upgrade to 2023.05.4 or later, preferably the latest TeamCity release. 2. For older versions that could not be upgraded immediately, JetBrains provided a security patch plugin for versions 8.0 and up. Treat it as temporary and still upgrade. 3. Do not expose TeamCity to the internet unless required; place it behind VPN or an allow list. 4. If an unpatched server was reachable, assume compromise. Review for unknown admin users and API tokens, unexpected build configurations or agents, and unfamiliar files and processes on the server; CISA's advisory lists detection guidance. Rebuild the server from a clean state, rotate all secrets, tokens, SSH keys and signing keys that builds could access, and audit recent build artifacts and repositories for tampering. Verify: the version is 2023.05.4 or newer, and no unknown users, tokens or build steps exist. Sources: https://blog.jetbrains.com/teamcity/2023/09/cve-2023-42793-vulnerability-post-mortem/ https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a https://nvd.nist.gov/vuln/detail/CVE-2023-42793