The SolarWinds hackers are infiltrating JetBrains TeamCity servers via a critical vulnerability enabling authorization bypass and arbitrary code execution, government officials warn.
Russian Foreign Intelligence Service-backed threat actor CozyBear has been exploiting the bug tracked as CVE-2023-42793 since September, according to a joint advisory from CISA, the FBI, the NSA and international partners.
A patch was made available on Sept. 18 in TeamCity version 2023.05.4.
The critical vulnerability enables unauthenticated attackers to gain administrator access to TeamCity servers and achieve remote code execution without the need for user interaction, according to SonarSource.
SonarSource first discovered the flaw in on-premises TeamCity servers and disclosed the details publicly on Sept. 26.
TeamCity servers are Continuous Integration and Continuous Deployment servers many software companies use to manage and automate software development processes like building, testing and releasing.
More than 30,000 JetBrains customers use TeamCity servers, and more than 3,000 on-premises servers were directly exposed to the internet when the bug was discovered, SonarSource said.
CozyBear hackers use JetBrains security flaw to compromise dozens of companies.
The Russia-backed cybergang CozyBear, which conducted the massive SolarWinds supply chain attack in 2020, has compromised dozens of companies and more than a hundred devices by exploiting the JetBrains TeamCity flaw, officials said.
Companies in the United States, Europe, Asia and Australia have been affected.
The joint government advisory states identified victims include companies that provide software for billing, financial management, sales, marketing, customer care, employee monitoring, medical devices and video games.
The attackers also compromised small and large IT companies and an energy trade association, according to the advisory.
CozyBear was seen using the Mimikatz tool to steal credentials from the Windows Registry and escalate privileges on compromised systems.
JetBrains updated its blog on Thursday notifying customers about the exploitation and reiterating recommendations to update on-premises TeamCity servers to version 2023.05.4 or later.
Shadowserver, a nonprofit organization that tracks and analyzes malicious web activity, said on Wednesday it detected 800 unpatched instances of JetBrains TeamCity across the globe.
SolarWinds hack heightens supply chain attack worries.
SVR and CozyBear pulled off the notorious SolarWinds attack by leveraging access to the source code and trusted certificates of SolarWinds' Orion software.
The hackers injected its SUNBURST/Solorigate malware in Orion software updates to stealthily spread the malware backdoor to SolarWind's enterprise customers.
The advisory by CISA and partners notes that SolarWinds-like access to source code and certificates can be achieved by exploiting the JetBrains TeamCity vulnerability.
Services like TeamCity remain a prime target for threat actors working for foreign intelligence agencies.
This Cyber News was published on packetstormsecurity.com. Publication date: Fri, 15 Dec 2023 15:43:04 +0000