CVE-2023-42793

CVE-2023-42793 is a critical security vulnerability identified in JetBrains TeamCity build management and continuous integration server. This flaw, characterized by an authentication bypass, was exploited by multiple threat actors throughout 2023 and into 2024. The first notable exploitation occurred in September 2023, with the threat group BianLian capitalizing on this vulnerability to conduct a supply chain attack. In addition to BianLian, Microsoft reported two North Korean threat groups, known as Diamond Sleet (or Zinc) and Onyx Sleet (or Plutonium), exploiting this remote code execution vulnerability. The North Korea-backed hacking groups Lazarus (Diamond Sleet) and Andariel (Onyx Sleet) have been particularly active in exploiting CVE-2023-42793. Microsoft outlined in October 2023 how these groups used this critical authentication bypass vulnerability in the JetBrains TeamCity server to breach target systems. By establishing persistent access to compromised hosts, they were able to use them as a beachhead for more widespread compromise of companies' systems and networks. In their attacks, these threat groups have also employed a custom proxy tool called HazyLoad, previously identified by Microsoft as part of intrusions weaponizing critical security flaws in JetBrains TeamCity. Specifically, Diamond Sleet was implicated last month in exploiting CVE-2023-42793, which has a high CVSS score of 9.8, to opportunistically breach vulnerable servers and deploy a backdoor known as ForestTiger. These incidents underscore the severity of the vulnerability and the need for organizations to apply patches promptly to protect their systems.