JetBrains Urges Prompt Patching of Latest Critical TeamCity Vulnerability

JetBrains is advising all TeamCity (on-premises) users to swiftly upgrade to the most recent version in response to the disclosure of a critical vulnerability in the CI/CD tool.

Identified as CVE-2024-23917, the vulnerability has been assigned a provisional CVSS score of 9.8 and enables unauthenticated remote attackers to seize control of vulnerable servers with admin privileges.

Daniel Gallo, a solutions engineer at JetBrains, stated in an advisory, "This issue affects all versions from 2017.1 through 2023.11.2. The problem has been addressed in version 2023.11.3. We strongly recommend upgrading as soon as possible."

The vulnerability necessitates attention solely for administrators of on-premises servers, as TeamCity Cloud has already been patched. JetBrains also confirmed that no attacks had been observed against TeamCity Cloud but did not provide similar assurances about the on-premises product.

Patching can be performed by downloading the latest version, utilizing the automatic update feature within TeamCity, or using the security patch plugin, which specifically addresses CVE-2024-23917.

JetBrains advises that it's preferable to upgrade the entire server rather than solely patching the single vulnerability, as users will then receive all other accompanying security fixes.

If, for any reason, patches or mitigations cannot be immediately applied, it is recommended that public-facing TeamCity servers be made inaccessible until the critical flaw is remedied.

This disclosure follows closely on the heels of revelations that state-sponsored attackers from Russia and North Korea were separately targeting vulnerable TeamCity servers with a similar flaw announced in September.