erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: September 18, 2023

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: TeamCity CVE-2023-42793: Auth Bypass to RCE, State-Exploited. Owners of self-hosted TeamCity servers that ran a version before 2023.05.4 while reachable from the internet, and anyone still running an old build protected only by the patch plugin.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2023-42793

TeamCity CVE-2023-42793: Auth Bypass to RCE, State-Exploited

Fixed since September 2023 and mass-exploited since; confirm no TeamCity server is still on an old build, and if one was internet-facing and unpatched in late 2023, hunt for a planted foothold rather than assuming the later upgrade cleaned it.

Must act: Owners of self-hosted TeamCity servers that ran a version before 2023.05.4 while reachable from the internet, and anyone still running an old build protected only by the patch plugin.

Can relax: TeamCity Cloud customers, and on-prem teams that upgraded promptly in September 2023, keep current releases and never exposed the server publicly.

  1. Inventory every TeamCity On-Premises server and record its version from the web UI footer or GET /app/rest/server.
  2. Upgrade anything older than 2025.11.7 or 2026.1.3 to a current release; the 2023 patch plugin does not cover later bugs.
  3. Remove direct internet exposure: put TeamCity behind a VPN or an IP allowlist.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.