Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

JetBrains TeamCity Unauthenticated RCE exploit module (CVE-2024-27198) #18922

Merged
merged 29 commits into from Mar 13, 2024
Merged

JetBrains TeamCity Unauthenticated RCE exploit module (CVE-2024-27198) #18922

Show file tree
Hide file tree
Changes from 19 commits
Commits
Show all changes
29 commits
Select commit Hold shift + click to select a range
cdba70b
add in jetbrains teamcity rce 0day
sfewer-r7 Feb 16, 2024
04d501a
make msftidy happy
sfewer-r7 Feb 16, 2024
32ed8ee
rework some of the cleanup logic
sfewer-r7 Feb 16, 2024
a8408f1
add in ARCH_CMD payloads to get a native meterpreter session
sfewer-r7 Feb 16, 2024
edf2bae
add native java payload support
sfewer-r7 Feb 19, 2024
d5bcac1
improve check routine to include target platform
sfewer-r7 Feb 23, 2024
30e7618
we can also register this path for cleanup
sfewer-r7 Feb 23, 2024
47596c6
add in docs
sfewer-r7 Feb 23, 2024
8bca294
use the Faker library
sfewer-r7 Feb 27, 2024
f52543b
Older version of TeamCity (circa 2018) do not support access tokens, …
sfewer-r7 Feb 27, 2024
b7200b5
typo
sfewer-r7 Feb 27, 2024
f0ca5c1
we can shuffle thequery params so teh jsp param is not first. we can …
sfewer-r7 Feb 29, 2024
fa4a16d
add in cve number
sfewer-r7 Mar 1, 2024
9988117
rename with cve number
sfewer-r7 Mar 1, 2024
a5fb83d
add in 2023.11.2 as tested on
sfewer-r7 Mar 1, 2024
d748adc
check the expected response from a patched server
sfewer-r7 Mar 4, 2024
aac4ef0
add in disclosure date and blogs
sfewer-r7 Mar 5, 2024
b925f79
typo and clarify description
sfewer-r7 Mar 5, 2024
5c56d6a
typo
sfewer-r7 Mar 5, 2024
ab0327f
clarify we are using SpEL not OGNL here
sfewer-r7 Mar 8, 2024
0513654
Fix edge case for java payloads when Spawn is set to 0, all access to…
sfewer-r7 Mar 8, 2024
1e371d0
resolve teh Java payload issue on Linux by leveraging PayloadServlet,…
sfewer-r7 Mar 11, 2024
46dd21d
use ||= to assign new hash if needed
sfewer-r7 Mar 13, 2024
d7bf7bc
Use Failure::NoAccess as a better failure error, as we are trying to …
sfewer-r7 Mar 13, 2024
b9e8237
typo
sfewer-r7 Mar 13, 2024
df2c94f
anther typo
sfewer-r7 Mar 13, 2024
b04e84e
clarify we must call this a second time
sfewer-r7 Mar 13, 2024
4bd1052
improve the readability of the XML
sfewer-r7 Mar 13, 2024
6d84f0e
reduce the size of teh exploit method by spinngin out two new methods…
sfewer-r7 Mar 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view