Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2023-42793 | 9.8 | 100.0% | ✅ listed | available | 90.5 (Critical) |
The TeamCity RCE that's being hammered
CVE-2023-42793 is an unauthenticated remote code execution flaw in JetBrains TeamCity On-Premises, tracked as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). It carries a CVSS 3.1 score of 9.8 and an EPSS score of 100.0% (100th percentile), placing it in the top tier of actively exploited bugs. The vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, and a public proof-of-concept is available.
Exploitation began in September 2023, shortly after JetBrains shipped the fix in TeamCity 2023.05.4 and Rapid7 published a public PoC. As of September 25, 2023, Rapid7 had not yet seen in-the-wild exploitation, but that changed quickly. The bug now has a global footprint: APT29 and several North Korea-backed APTs are hammering exposed TeamCity servers at scale, with the feds confirming the exploitation wave. The flaw affects TeamCity On-Premises versions 2023.05.3 and earlier, and an unauthenticated remote attacker can achieve RCE on the TeamCity Server.
How the flaw works
The flaw works by letting an attacker bypass TeamCity’s authentication check through an alternate path or channel, as classified under CWE-288. An unauthenticated remote attacker sends a crafted request over HTTPS to the TeamCity Server, which grants administrative privileges without a valid session. From there, the attacker achieves remote code execution on the server process.
The bug affects TeamCity On-Premises 2023.05.3 and earlier; JetBrains shipped the fix in 2023.05.4. Stefan Schiller of Sonar reported the vulnerability and noted that attackers can inject malicious code into the build process, compromising software releases for all downstream consumers. Rapid7 published a technical analysis with indicators of compromise, and Caitlin Condon, head of vulnerability research at Rapid7, confirmed that as of September 25, 2023, no public exploit code was available and no in-the-wild exploitation had been observed.
Who's exploiting it
APT29, the Cobalt Group, is the lead state actor exploiting CVE-2023-42793, with several North Korea-backed APTs following per Microsoft’s Threat Intelligence Center. The feds confirm the exploitation wave is hitting exposed TeamCity servers at scale, a pattern that typically signals a high-value target in the build pipeline.
Fortinet and Microsoft both flag the bug as a top-priority target for dev teams, recommending that both the TeamCity server and build agents be vetted for signs of compromise. JetBrains’s own advisory is more direct: it recommends removing any publicly accessible TeamCity server from the internet while teams patch and investigate for compromise.
RunZero asset discovery
RunZero is the primary tool for mapping the blast radius. Security teams are using it to scan the internet for exposed TeamCity instances running the vulnerable version, which is critical before the APTs finish their sweep. The scanner identifies the TeamCity server by its characteristic HTTP response and version string, flagging instances that are still on 2023.05.3 or earlier.
Greynoise is tracking a large number of IP addresses actively sending exploit attempts against CVE-2023-42793, confirming that the scanning is widespread and not just a few researchers poking at the same handful of servers. The IP distribution matches the pattern you see when APT29 and the North Korea groups are running their own scanning infrastructure in parallel with the public PoC.
Why it's a supply-chain nightmare
TeamCity is a CI/CD server, so the RCE isn’t just a web app compromise — it’s control over the build process itself. An attacker who lands on the server can inject malicious code into the build pipeline, which means every artifact that server produces from that point on is potentially tainted. That’s the SolarWinds-style nightmare: one compromised server poisons every downstream release it builds, and the blast radius extends to every consumer pulling from that TeamCity instance.
The CVSS 9.8 (CVSS 3.1) and EPSS 100.0% (100th percentile) put this in the top tier for unauthenticated RCEs. It’s in CISA’s KEV list, and a public PoC is out, so the window for unpatched servers is short. PRS rates it 90.5, which is Critical territory.
Key points
- CVE-2023-42793 is an authentication bypass (CWE-288) in TeamCity On-Premises ≤ 2023.05.3, fixed in 2023.05.4.
- CVSS 3.1 score 9.8, EPSS 100.0% (100th percentile), CISA KEV-listed, Rapid7 PoC public.
- Unauthenticated remote attacker achieves RCE on TeamCity Server, enabling build-agent code injection and downstream supply-chain compromise.
- RunZero asset discovery surfacesing exposed TeamCity instances; exploitation via HTTPS bypasses auth to gain admin.
- JetBrains recommends removing public servers from the internet during patching and compromise investigation.