Critical TeamCity Bug Allows for Server Takeovers
07-Feb-24
TeamCity is a software development lifecycle (SDLC) management platform that about 30,000 organizations — including several major brands like Citibank, Nike, and Ferrari — use to automate processes to build, test, and deploy software. As such, it’s home to scores of data that can be useful to attackers, including source code and signing certificates, and also could allow for tampering with compiled versions software or deployment processes.
The flaw, tracked as CVE-2024-23917, presents the weakness CWE-288, which is an authentication bypass using an alternate path or channel. JetBrains identified the flaw on Jan. 19; it affects all versions from 2017.1 through 2023.11.2 of its TeamCity On-Premises continuous integration and delivery (CI/CD) server.
