TeamCity CVE-2023-42793: Auth Bypass to RCE, State-Exploited

What to do

1. Inventory every TeamCity On-Premises server and record its version from the web UI footer or GET /app/rest/server.
2. Upgrade anything older than 2025.11.7 or 2026.1.3 to a current release; the 2023 patch plugin does not cover later bugs.
3. Remove direct internet exposure: put TeamCity behind a VPN or an IP allowlist.
4. If a server was internet-facing and unpatched in fall 2023 and never investigated, run the hunt below and rotate every secret it stores.
5. Treat confirmed compromise as a build-pipeline incident: rebuild the host and verify artifacts and signing keys produced since then.

How to check if you are affected or compromised

• Look for an access token named RPC2 on any user, especially the default admin (id:1); Sonar calls it a strong indicator, though attackers may rename or delete it.
• grep teamcity-server.log for edits to internal.properties and for 'External process is launched by user' entries.
• Search reverse-proxy logs for /app/rest/users/id:1/tokens/RPC2, unexpected POSTs to /app/rest/users and calls to /app/rest/debug/processes.
• Check hosts against the AA23-347A indicators (GraphicalProton hashes, scheduled tasks) and the IP indicators in Microsoft's October 2023 report.

What happened#

On September 18, 2023, JetBrains shipped TeamCity 2023.05.4 to fix CVE-2023-42793, an authentication bypass (CWE-288) in TeamCity On-Premises reported by Sonar on September 6. The CVE was published on September 19 and the coordinated blog posts went out on September 21, according to the JetBrains post-mortem. The vendor advisory says an unauthenticated attacker with HTTP(S) access could get remote code execution and administrative control of the server. JetBrains, as CNA, scores it CVSS 3.1 9.8 on the CVE record.

Sonar's write-up explains the root cause. A request interceptor skipped pre-handling, including authorization, for any path matching /**/RPC2. Because the wildcard accepted any prefix, POST /app/rest/users/id:1/tokens/RPC2 returned a valid token for the default admin, with no login at all. Sonar published full details on September 27, after a public exploit appeared.

Exploitation started quickly. CISA added the CVE to the KEV catalog on October 4, 2023, with an October 25 deadline, and marks known ransomware use. On October 18, Microsoft said two North Korean actors, Diamond Sleet and Onyx Sleet, had been exploiting it since early October. On December 13, the FBI, CISA, NSA, Poland's SKW, CERT Polska and the UK NCSC published AA23-347A. It says Russia's SVR (APT29) had exploited the bug "at a large scale" since September 2023, then escalated privileges, moved laterally and deployed the GraphicalProton backdoor.

Who is affected#

All TeamCity On-Premises versions before 2023.05.4. TeamCity Cloud was not affected. For servers that could not upgrade, JetBrains also released a security patch plugin covering TeamCity 8.0 through 2023.05.3. It fixes only this bug.

Do you really need to act?#

Most teams patched three years ago, so the verdict today is check exposure, not act now. Two things still matter. First, a server still running a 2023-era build, or one that got the plugin and was never upgraded, is also open to newer bugs. That includes CVE-2026-63077, an unauthenticated RCE fixed in 2025.11.7 and 2026.1.3. Second, the joint advisory told any organization that did not patch immediately to assume compromise. A CI server holds source code, signing keys and deployment credentials, and the SVR used it to settle in for the long term. A later upgrade does not remove a backdoor planted before it. JetBrains' October 2023 update also confirmed exploitation attempts.

What to do now#

1. List every TeamCity On-Premises server and record its version from the web UI footer or from curl -s -H "Authorization: Bearer $TOKEN" https://teamcity.example.com/app/rest/server (the version attribute).
2. Upgrade anything below 2025.11.7 or 2026.1.3 to a current release. Do not rely on the 2023 plugin.
3. Remove direct internet exposure and put the server behind a VPN or an IP allowlist.
4. If a server was reachable and unpatched in fall 2023 and was never investigated, run the checks below and rotate every VCS token, cloud key and deploy credential it stores.

How to tell if you were hit#

• Look for an access token named RPC2 on any user, especially id 1. Sonar calls it a strong indicator, but attackers may have renamed or deleted it.
• Run grep -E 'internal.properties|External process is launched' teamcity-server*.log in the server's logs directory. The advisory shows both entries in real attacks.
• Search reverse-proxy logs for /app/rest/users/id:1/tokens/RPC2, unexpected POSTs to /app/rest/users, and calls to /app/rest/debug/processes. TeamCity does not log individual HTTP requests.
• Check for unknown admin accounts, and compare the hosts against the AA23-347A file hashes and scheduled-task indicators.

Timeline#

• Sep 6, 2023 — Sonar reports the bug to JetBrains.
• Sep 18, 2023 — TeamCity 2023.05.4 is released and customers are notified.
• Sep 21, 2023 — JetBrains and Sonar publish coordinated disclosures.
• Sep 27, 2023 — Sonar releases full details after a public exploit.
• Oct 4, 2023 — CISA adds CVE-2023-42793 to KEV.
• Oct 18, 2023 — Microsoft reports North Korean exploitation.
• Dec 13, 2023 — Joint advisory AA23-347A attributes large-scale exploitation to the SVR.

Vulnerability records

• CVE-2023-42793 · KEV 2023-10-04 · In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. JetBrains — Critical Security Issue Affecting TeamCity On-Premises: Update to 2023.05.4 Now blog.jetbrains.com
2. JetBrains — CVE-2023-42793 Vulnerability in TeamCity: Post-Mortem blog.jetbrains.com
3. JetBrains — CVE-2023-42793 Vulnerability in TeamCity: October 9, 2023 Update blog.jetbrains.com
4. CVE record — CVE-2023-42793 cve.org
5. NVD — CVE-2023-42793 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2023-42793 cisa.gov
7. CISA, FBI, NSA, SKW, CERT Polska, NCSC — AA23-347A: Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally cisa.gov
8. CVE record — CVE-2026-63077 cve.org
9. Sonar — Source Code at Risk: Critical Code Vulnerability in CI/CD Platform TeamCity sonarsource.com
10. Microsoft Threat Intelligence — Multiple North Korean threat actors exploiting the TeamCity CVE-2023-42793 vulnerability microsoft.com