CVE-2023-42793

JetBrains TeamCity before 2023.05.4 has an authentication bypass in its server that leads directly to remote code execution. By hitting a specific request path an attacker can generate an administrator access token without any credentials, then use that token through TeamCity's own REST API to modify server settings and execute code on the host. The whole chain is unauthenticated and needs no user interaction, so exposure of the TeamCity web interface is exposure of the build server itself.

TeamCity is a CI/CD server, which makes this a supply-chain problem, not just a single-host compromise: the build system holds source code, signing keys, deployment credentials, and the ability to inject code into software that ships to downstream users. State-sponsored actors, including groups attributed to Russian and North Korean services, weaponized this quickly to plant backdoors in developer environments, and commodity attackers followed. Update to the fixed TeamCity version or apply the vendor's security patch plugin for older lines, keep the server off the public internet, and because compromise here is high-consequence, audit for rogue admin tokens, altered build configurations, and unexpected artifacts created before you patched.