Caitlin Condon

An authentication bypass exists in the server API due to insufficient access control, allowing an unauthenticated remote attacker to gain administrative access to the console and guest portal. This can lead to remote code execution (RCE) on the TeamCity Server and its agents, enabling the theft of source code, service secrets, and private keys, or the injection of malicious code into software builds to facilitate supply chain attacks. The issue is exploited by sending a request matching the pattern `/**/RPC2` to the undocumented endpoint `/app/rest/users/id:1/tokens/RPC2` to retrieve the authentication token of the default administrator account. Real-world exploitation has been observed on a large scale by state-sponsored actors, including APT 29 (CozyBear/NOBELIUM/Midnight Blizzard), Lazarus Group, Diamond Sleet, and Onyx Sleet. Approximately 1,258 potentially affected instances were identified via ZoomEye, with over 3,000 servers reported as directly connected to the internet via Shodan.

Fortra GoAnywhere MFT is susceptible to a pre-authentication command injection due to the deserialization of attacker-controlled objects within the License Response Servlet. The Clop ransomware group actively exploited this issue, identified as CVE-2023-0669, to steal data from over 130 organizations within a ten-day period. The vulnerability allows attackers to execute arbitrary code by sending a POST request to the `/goanywhere/lic/accept` endpoint with a malicious object. The exploitation of this vulnerability has been linked to TA505 and the Clop ransomware group, mirroring tactics used in previous attacks against Accellion FTA in 2021. The vulnerability requires the administrative functions to be exposed over the internet, typically on ports 8000/tcp and 8001/tcp/tls.