5 ms·

JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities (Fixed)

32 points by LinuxBender 3y ago

uticus 3y ago
> When Rapid7 contacted JetBrains about their uncoordinated vulnerability disclosure, JetBrains published an advisory on the vulnerabilities without responding to Rapid7 on the disclosure timeline. JetBrains later responded to indicate that CVEs had been published. Is this a failure on JetBrain's part to acknowledge the issue and properly give credit for discovering the CVE?
- jeffmcjunkin 3y ago
  Yup, silently patching (like JetBrains did) has a lot of downsides. Let alone the deception from JetBrains to the Rapid7 team. (Disclosure: I know some of the folk on the Rapid7 side, so I'm perhaps biased towards their interpretation of events)
  - xmodem 3y ago
    What deception are you referring to? I don't see anything in the linked article that I would consider to be an accusation of deception.
    - jeffmcjunkin 3y ago
      Sorry, it was alluded to elsewhere: https://infosec.exchange/@iagox86/112045097519922098 https://infosec.exchange/@iagox86/112045097519922098 There's more to the story that Rapid7 didn't want to air publicly, and none of it is good for JetBrains.
      - xmodem 3y ago
        The linked timeline from JetBrain's side doesn't exactly shower them with glory - taking more than a week to respond to with CVE numbers is not ideal. But the linked toot states: > it's super inappropriate to lie to researchers who disclosed this to you responsibly about what your plans are. That would be super inappropriate, yes! But Rapid7 hasn't alleged that publicly that I've seen. All I have seen so far is researchers alluding to bad behaviour and deception, and no concrete or falsifiable accusations. Cutting Rapid7 out of the disclosure is definitely poor form, but that's a far cry from lies and deception. As a not-totally-disinterested outside observer (using JetBrains' IDE products but not TeamCity) I definitely want to know if they are behaving badly so I can factor that into my future plans. But without a concrete falsifiable accusation it reads to me like butthurt on the part of the researchers involved.
- deleted 3y ago
  [deleted]
daveoc64 3y ago
See also: https://news.ycombinator.com/item?id=39603074 https://news.ycombinator.com/item?id=39603074
igor_akhmetov 3y ago
The full timeline for the side of JetBrains is described here: https://blog.jetbrains.com/teamcity/2024/03/our-approach-addressing-recently-discovered-vulnerabilities-in-teamcity-on-premises/ https://blog.jetbrains.com/teamcity/2024/03/our-approach-add...
deleted 3y ago
[deleted]
uticus 3y ago
> Note: The JetBrains release blog for 2023.11.4 appears to display different publication dates based on the time zone of the reader. Some readers see that it was released March 3, while others see March 4. We've modified our language above to note that Rapid7 saw the release blog on March 4, regardless of what time it was released. If the contention is when to release details, then should agree on UTC for all parties, with appropriate time precision. Anything else is adding obscurity to an already difficult-to-follow plot.

32 points by LinuxBender 3y ago

> When Rapid7 contacted JetBrains about their uncoordinated vulnerability disclosure, JetBrains published an advisory on the vulnerabilities without responding to Rapid7 on the disclosure timeline. JetBrains later responded to indicate that CVEs had been published. Is this a failure on JetBrain's part to acknowledge the issue and properly give credit for discovering the CVE?

jeffmcjunkin 3y ago
Yup, silently patching (like JetBrains did) has a lot of downsides. Let alone the deception from JetBrains to the Rapid7 team. (Disclosure: I know some of the folk on the Rapid7 side, so I'm perhaps biased towards their interpretation of events)
- xmodem 3y ago
  What deception are you referring to? I don't see anything in the linked article that I would consider to be an accusation of deception.
  - jeffmcjunkin 3y ago
    Sorry, it was alluded to elsewhere: https://infosec.exchange/@iagox86/112045097519922098 https://infosec.exchange/@iagox86/112045097519922098 There's more to the story that Rapid7 didn't want to air publicly, and none of it is good for JetBrains.
    - xmodem 3y ago
      The linked timeline from JetBrain's side doesn't exactly shower them with glory - taking more than a week to respond to with CVE numbers is not ideal. But the linked toot states: > it's super inappropriate to lie to researchers who disclosed this to you responsibly about what your plans are. That would be super inappropriate, yes! But Rapid7 hasn't alleged that publicly that I've seen. All I have seen so far is researchers alluding to bad behaviour and deception, and no concrete or falsifiable accusations. Cutting Rapid7 out of the disclosure is definitely poor form, but that's a far cry from lies and deception. As a not-totally-disinterested outside observer (using JetBrains' IDE products but not TeamCity) I definitely want to know if they are behaving badly so I can factor that into my future plans. But without a concrete falsifiable accusation it reads to me like butthurt on the part of the researchers involved.
deleted 3y ago
[deleted]

daveoc64 3y ago

See also: https://news.ycombinator.com/item?id=39603074 https://news.ycombinator.com/item?id=39603074

igor_akhmetov 3y ago

The full timeline for the side of JetBrains is described here: https://blog.jetbrains.com/teamcity/2024/03/our-approach-addressing-recently-discovered-vulnerabilities-in-teamcity-on-premises/ https://blog.jetbrains.com/teamcity/2024/03/our-approach-add...

deleted 3y ago

[deleted]

uticus 3y ago

> Note: The JetBrains release blog for 2023.11.4 appears to display different publication dates based on the time zone of the reader. Some readers see that it was released March 3, while others see March 4. We've modified our language above to note that Rapid7 saw the release blog on March 4, regardless of what time it was released. If the contention is when to release details, then should agree on UTC for all parties, with appropriate time precision. Anything else is adding obscurity to an already difficult-to-follow plot.