Caitlin Condon

**Name of the Vulnerable Software and Affected Versions** JetBrains TeamCity versions prior to 2023.05.4 **Description** JetBrains TeamCity contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access to the server and execute arbitrary code. This vulnerability, identified as CVE-2023-42793, has been actively exploited by multiple threat actors, including those linked to North Korea (Diamond Sleet, Onyx Sleet, Lazarus Group) and Russia (APT29, CozyBear). Successful exploitation can lead to remote code execution, source code theft, and potential supply chain attacks. The vulnerability stems from insufficient access controls to the server's API. Several reports indicate that the vulnerability is being exploited in the wild, with attackers deploying malware and attempting to compromise systems. Approximately 1,200 vulnerable instances have been identified publicly. **Recommendations** Update TeamCity to version 2023.05.4 or later. If updating is not immediately possible, install the security patch plugin provided by JetBrains.

**Name of the Vulnerable Software and Affected Versions** Fortra GoAnywhere MFT versions prior to 7.1.2 **Description** Fortra GoAnywhere MFT is susceptible to a pre-authentication command injection due to the deserialization of attacker-controlled objects within the License Response Servlet. The Clop ransomware group actively exploited this issue, identified as CVE-2023-0669, to steal data from over 130 organizations within a ten-day period. The vulnerability allows attackers to execute arbitrary code by sending a POST request to the `/goanywhere/lic/accept` endpoint with a malicious object. The exploitation of this vulnerability has been linked to TA505 and the Clop ransomware group, mirroring tactics used in previous attacks against Accellion FTA in 2021. The vulnerability requires the administrative functions to be exposed over the internet, typically on ports 8000/tcp and 8001/tcp/tls. **Recommendations** Update Fortra GoAnywhere MFT to version 7.1.2 or later. Restrict access to the administrative console to prevent external access. As a temporary workaround, consider disabling the License Response Servlet until a patch can be applied. Monitor network traffic and logs for suspicious activity related to the `/goanywhere/lic/accept` endpoint.