how it happened
- whoAPT29 and othersCVE-2023-42793
- the gapunpatched CI servercode execution
- the resultglobal campaignjoint advisory December 2023
what everyone assumed
A CI/CD server feels like plumbing. It compiles, it packages, it signs, and it lives on the inside, which is the part that makes it feel safe: attackers are out there, and this is in here. The reasonable belief is that the interesting targets are the customer database and the email system, and the build server is just a tool that quietly serves the people who already have the keys.
what happened
On September 6, 2023, a critical authentication-bypass vulnerability in JetBrains TeamCity On-Premises was disclosed and given the identifier CVE-2023-42793, with a severity score of 9.8 out of 10. A patch followed within days. The vulnerability let an unauthenticated attacker bypass authorization and run code directly on the server. For organizations that did not apply the patch, the window stayed open while the work of the day went on, because nothing about a build compiling looks different when someone else can also reach it. By the time the joint advisory was published, the actors exploiting it included Russia’s foreign intelligence service, the group tracked as APT29, and the reach of the campaign was global.
step by step
- 6 September 2023a 9.8 authentication bypass in TeamCityUnauthenticated attackers can run code on the server.
- a patch follows; not everyone applies itBuilds keep compiling, so nothing looks wrong.the assumption breaks here
- APT29 exploits unpatched serversA global campaign.
- 13 December 2023joint advisory AA23-347AA build server can reach dozens of developers and what they ship.
how it surfaced
On December 13, 2023, CISA and partner agencies, including the FBI, the NSA, Poland’s military counterintelligence service, CERT Polska, and the UK’s NCSC, published advisory AA23-347A. The assessment was specific about why a build server was worth the effort: compromising it could give an intelligence service access to the networks of dozens of software developers, and to everything those developers build. The machine that felt like plumbing was a position. Whatever it built, an attacker who held it could shape on the way out.
A build server is not a tool that sits below the things worth protecting.
It is upstream of them, because it touches the code, the signatures, and the credentials of everything it ships, which is exactly why a patient actor reaches for it first.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersAn attacker uses the unpatched flaw to take over the build server.what it costs youFrom there they could change what you ship to every customer.
- or it goes like thisit happenedSolarWinds / Sunburst, 2020howA genuine, signed update from a certified vendor carries a backdoor.what leavesa quiet way into your networkwho ends up with ita state intelligence service
- or it goes like thisit happenedtj-actions/changed-files, 2025howA build helper everyone uses is hijacked and its versions repointed.what leavessecret keys, printed into build logswho ends up with itanyone reading public logs
sources
your turn
what you can do about it
this week
Find your CI/CD and build infrastructure on the patch list and check where it sits relative to your internet-facing services, and look at which credentials and signing keys it can reach if someone else is holding it.
Somewhere in your environment is a server that compiles or deploys, installed by someone who has since changed teams, patched on a schedule that is slower than your customer-facing systems because it never faces a customer. That gap is the assumption.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →