Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In
The Hacker News reported a critical security flaw in JetBrains TeamCity that could let attackers run operating system commands without needing to log in. The vulnerability, which affects the popular CI/CD server, is considered severe because it requires no authentication, making it exploitable by anyone who can reach the TeamCity server over the network. The article did not specify a CVE ID or exact version range, but it emphasized the urgency for organizations to patch their installations. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying system, potentially leading to full compromise of the TeamCity server and any connected build agents. This could enable attackers to steal secrets, modify build artifacts, or pivot to other internal systems. The report did not provide details on how the flaw was discovered or whether it is being actively exploited in the wild.
Unauthenticated remote code execution in a CI/CD server can lead to supply chain compromise.