JetBrains urges swift patching of latest critical TeamCity flaw

JetBrains is encouraging all users of TeamCity (on-prem) to upgrade to the latest version following the disclosure of a critical vulnerability in the CI/CD tool. Tracked as CVE-2024-23917, the vulnerability has been assigned a provisional 9.8 CVSS score and allows unauthenticated remote attackers to take over vulnerable servers with admin privileges. "All versions from 2017.1 through 2023.11.2 are affected by this issue," Daniel Gallo, solutions engineer at JetBrains, said in an advisory. "The issue has been patched in 2023.11.3. We recommend upgrading as soon as possible." The vulnerability only requires attention for admins of on-prem servers since TeamCity Cloud has already been patched. JetBrains also confirmed that no attacks had been detected against TeamCity Cloud, but made no such assertions about the on-prem product. Patching can be carried out by downloading the latest version, using the automatic update feature within TeamCity itself, or by using the security patch plugin which addresses CVE-2024-23917 only. JetBrains said it's always best to just upgrade the whole server – as users will then receive all the other security fixes that come with it – rather than just patching the single vulnerability. If, for whatever reason, any of the patches or mitigations can't be applied immediately, it's recommended that public-facing TeamCity servers should be made inaccessible until the critical flaw is addressed. The disclosure comes just a few months after it was revealed t...