AdvisoriesCISAAA23-347ADecember 13, 2023
December 13, 2023
The US FBI, CISA, NSA, Poland's SKW, CERT Polska, and the UK's NCSC have issued a warning that Russian SVR cyber actors, known as APT 29 or CozyBear, are exploiting a vulnerability in JetBrains TeamCity software (CVE-2023-42793) to target software developers. This exploitation could lead to compromised source code and supply chain attacks, similar to the 2020 SolarWinds breach. The agencies advise entities with affected systems to assume compromise if patches were not applied and to conduct threat hunting using provided indicators of compromise (IOCs). The SVR's activities are part of a broader pattern of targeting technology companies and collecting foreign intelligence, including political, economic, and technological information.
This CVE represents a critical security flaw that allows unauthorized remote code execution, potentially giving attackers deep access to the software development environment. The exploitation of this vulnerability is particularly alarming because TeamCity is widely used in the software industry for automating building, testing, and deployment processes. An attacker exploiting this CVE could gain access to sensitive source code, manipulate software development workflows, and possibly insert malicious code into software products. This would compromise the integrity of the development process and pose a substantial risk to downstream software supply chains. The revelation of Russian SVR cyber actors exploiting this vulnerability underscores its severity and the need for immediate patching and heightened security measures by all users of the affected software. The ease of exploitation involved with this vulnerability - a simple request to a specific vulnerable endpoint - underscores the importance of automatic patching. Upgrading software is a manual and time-consuming process for many organizations, especially larger ones. Each upgrade carries a certain amount of risk, as the change set may be incompatible with other critical applications on the system. However, it is possible to establish a process of safe automated patching - and setting one up should be a top priority.
Be immediately notified of new advisories and associated security tests
