Merge pull request #710 from sT0wn-nl/patch-11

Create DIVD-2024-0006.md

_cases/2024/DIVD-2024-00006.md

@@ -0,0 +1,53 @@
+---
+layout: case
+title: Authentication Bypass in JetBrains TeamCity
+excerpt: "Successful exploitation of CVE-2024-23917 allows an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and gain administrative control of that TeamCity server."
+author: Alwin Warringa
+lead: Alwin Warringa
+researchers:
+- Alwin Warringa
+- Axel Boesenach
+- Barre Dijkstra
+- Gerben van de Wiel
+- Martin van Wingerden
+cves:
+- CVE-2024-23917
+product: 
+- JetBrains TeamCity
+versions: 
+- All TeamCity On-Premises versions from 2017.1 through 2023.11.2
+recommendation: "Upgrade to the latest available version as soon as possible or apply the provided security patch"
+patch_status: Released
+workaround: Install the JetBrains-provided security patch.
+status : open
+start: 2024-02-08
+end: 
+timeline:
+- start: 2024-02-08
+  end:
+  event: "DIVD starts researching this vulnerability."
+#ips: 
+# ips is used for statistics after the case is closed. If it is not applicable, you can set IPs to n/a (e.g. stolen credentials)
+# This field becomes mandatory when the case status is set to 'Closed'
+
+# You can set IPs to n/a when this case isn't about IPs (e.g. stolen credentials)
+---
+## Summary
+
+A critical security issue was recently identified in TeamCity On-Premises. If abused, the flaw may enable an unauthenticated attacker with HTTP(S) access to a TeamCity server to perform bypass authentication checks and gain administrative control of that TeamCity server. 
+
+## Recommendations
+
+JetBrains advises On-Prem users to upgrade to the latest available version as soon as possible or install the security patch. See the references for the download links.
+
+## What we are doing
+
+DIVD is currently working to identify vulnerable instances and notify the owners of these systems. 
+
+{% comment %}  Leave this here, so we see a timeline {% endcomment %}
+{% include timeline.html %}
+
+## More information
+* [JetBrains Advisory](https://blog.jetbrains.com/teamcity/2024/02/critical-security-issue-affecting-teamcity-on-premises-cve-2024-23917/)
+* [CVE-2024-23917](https://nvd.nist.gov/vuln/detail/CVE-2024-23917)
+* {% cve CVE-2024-23917 %}