{"id":90060,"date":"2024-02-06T00:00:00","date_gmt":"2024-02-06T05:00:00","guid":{"rendered":"https:\/\/staging.checkmarx.com\/?p=90060"},"modified":"2025-01-03T10:36:12","modified_gmt":"2025-01-03T08:36:12","slug":"navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies","status":"publish","type":"zero-post","link":"https:\/\/checkmarx.com\/blog\/navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies\/","title":{"rendered":"Navigating the Rising Tide of CI\/CD Vulnerabilities: The Jenkins and TeamCity Case Studies"},"content":{"rendered":"<p>In the evolving landscape of cybersecurity, a new threat has emerged, targeting the core of software development processes. Recently, an alarming incident has brought to light a significant vulnerability in Jenkins CI\/CD servers. Approximately&nbsp;<a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/45k-jenkins-servers-exposed-to-rce-attacks-using-public-exploits\/\">45,000 Jenkins servers have been left exposed to remote code execution (RCE) attacks<\/a>, leveraging multiple exploit public POCs&nbsp;<a href=\"https:\/\/github.com\/h4x0r-dz\/CVE-2024-23897\">https:\/\/github.com\/h4x0r-dz\/CVE-2024-23897<\/a>&nbsp;<a href=\"https:\/\/github.com\/binganao\/CVE-2024-23897\">https:\/\/github.com\/binganao\/CVE-2024-23897<\/a>. This breach is not just a standalone event but a symptom of a growing trend of attacks on Continuous Integration\/Continuous Deployment (CI\/CD) software supply chains.<\/p>\n\n\n\n<h2 class=\"wp-block-heading article-anchor\" id=\"article-anchor-1\"><strong>The significance of this vulnerability<\/strong><\/h2>\n\n\n\n<p>Exploiting this widespread vulnerability can do more than just initial access gleaned by exploiting the Jenkins CVE,&nbsp;it can also put the software consumers of this company affected, at immediate risk.&nbsp;<\/p>\n\n\n\n<p>Software developers use Build servers\u2019 software to manage and automate software compilation, building, testing, and releasing. If compromised, access to a build server would provide malicious actors with access to that software developer\u2019s source code, signing certificates, and the ability to subvert software compilation and deployment processes\u2014access a malicious actor could further use to conduct supply chain operations.<\/p>\n\n\n\n<p>The attraction of software supply chain attacks for attackers lies in their high reward potential and the extensive reach these attacks can have. By infiltrating a single, often well-trusted component of the software supply chain, attackers can gain access to a broad network of systems and data, making these attacks increasingly favored due to their far-reaching and often catastrophic ripple effects.<br>&nbsp;<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img decoding=\"async\" src=\"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/image-15-1.png\" alt=\"\" class=\"wp-image-95067\"><\/figure>\n<\/div>\n\n\n<p><strong>The growing trend of attacks on Continuous Integration\/Continuous Deployment (CI\/CD) software supply chains<\/strong><\/p>\n\n\n\n<p>This attack comes after a highly publicized attack on another CI\/CD server TeamCity software&nbsp;<a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2023-42793\">https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2023-42793<\/a>&nbsp;this attack was attributed by CISA to Russian Foreign Intelligence Service (SVR)&nbsp;<a href=\"https:\/\/www.cisa.gov\/news-events\/cybersecurity-advisories\/aa23-347a\">https:\/\/www.cisa.gov\/news-events\/cybersecurity-advisories\/aa23-347a<\/a>&nbsp;and also to multiple North Korean threat actors&nbsp;&nbsp;&nbsp;<a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/10\/18\/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability\/\">https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/10\/18\/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability\/<\/a>. We believe that this public vulnerability will also be used by Nation-state actors to strengthen their control on sensitive software supply chain.&nbsp;<br><\/p>\n\n\n\n<h2 class=\"wp-block-heading article-anchor\" id=\"article-anchor-2\"><strong>Beyond traditional security measures<\/strong><\/h2>\n\n\n\n<p>In the wake of sophisticated cyber-attacks like those attack, the limitations of traditional security tools such as antivirus software and intrusion detection systems become apparent. These tools, foundational for baseline security, are tailored to address known threats and vulnerabilities. However, their capacity to handle advanced cyber-attacks targeting software distribution mechanisms is limited. Such attacks often bypass perimeter defenses and exploit subtleties in software delivery systems, highlighting gaps in conventional security measures.<\/p>\n\n\n\n<p>The shortcomings of traditional approaches are further exemplified by tools like the Software Bill of Materials (SBOM). Although an SBOM is invaluable for transparency and tracking component vulnerabilities, it falls short in safeguarding against manipulations within the distribution process itself. This gap highlights the need for a more comprehensive approach to cybersecurity.<\/p>\n\n\n\n<p>Responding to these evolving threats necessitates a multifaceted security strategy. This involves complementing traditional measures with advanced and dynamic approaches. Implementing comprehensive vulnerability management, real-time threat detection systems, and continuous monitoring within the software development and deployment pipelines can provide a more robust defense.<\/p>\n\n\n\n<h2 class=\"wp-block-heading article-anchor\" id=\"article-anchor-3\"><strong>A call to action for AppSec managers<\/strong><\/h2>\n\n\n\n<p>Considering these growing threats, the role of Application Security (AppSec) Managers becomes more crucial than ever. The recent incidents involving Jenkins and TeamCity serve as stark reminders of the vulnerabilities inherent in the software supply chain. To combat this, AppSec Managers must ensure that their Software Supply Chain Security Solutions are not just robust but also backed by leading-edge research teams. It\u2019s not enough to have strong defenses; staying ahead of the curve in terms of threat intelligence and technological advancements is key to safeguarding against such sophisticated attacks.<\/p>\n\n\n\n<p>In conclusion, the cybersecurity community must view the incidents with Jenkins and TeamCity as a clarion call. The increasing frequency and sophistication of attacks on CI\/CD platforms demand a proactive and comprehensive approach to security. It&#8217;s a complex challenge, but with the right strategies and tools, organizations can protect themselves and their customers from these looming threats. As the digital world continues to evolve, so must our defenses against the ever-changing landscape of cyber threats.<\/p>","protected":false},"excerpt":{"rendered":"<p>In the evolving landscape of cybersecurity, a new threat has emerged, targeting the core of software development processes. Recently, an alarming incident has brought to light a significant vulnerability in Jenkins CI\/CD servers. Approximately&nbsp;45,000 Jenkins servers have been left exposed to remote code execution (RCE) attacks, leveraging multiple exploit public POCs&nbsp;https:\/\/github.com\/h4x0r-dz\/CVE-2024-23897&nbsp;https:\/\/github.com\/binganao\/CVE-2024-23897. This breach is not [&hellip;]<\/p>\n","protected":false},"author":53,"featured_media":90062,"template":"","zero-category":[1067],"zero-tag":[1093,1069,1068,1094,1073,1071],"class_list":["post-90060","zero-post","type-zero-post","status-publish","has-post-thumbnail","hentry","zero-category-blog","zero-tag-apma","zero-tag-appsec","zero-tag-checkmarx-security-research-team","zero-tag-ci-cd","zero-tag-english","zero-tag-supply-chain-security"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.1.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CI\/CD Vulnerabilities: The Jenkins and TeamCity Case Studies<\/title>\n<meta name=\"description\" content=\"Recently, an alarming incident has brought to light a significant vulnerability in Jenkins CI\/CD servers. Approximately\u00a045,000 Jenkins servers have been left exposed to remote code execution (RCE) attacks, leveraging multiple exploit public POCs\u00a0https:\/\/github.com\/h4x0r-dz\/CVE-2024-23897\u00a0https:\/\/github.com\/binganao\/CVE-2024-23897. This breach is not just a standalone event but a symptom of a growing trend of attacks on Continuous Integration\/Continuous Deployment (CI\/CD) software supply chains.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/checkmarx.com\/blog\/navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CI\/CD Vulnerabilities: The Jenkins and TeamCity Case Studies\" \/>\n<meta property=\"og:description\" content=\"Recently, an alarming incident has brought to light a significant vulnerability in Jenkins CI\/CD servers. Approximately\u00a045,000 Jenkins servers have been left exposed to remote code execution (RCE) attacks, leveraging multiple exploit public POCs\u00a0https:\/\/github.com\/h4x0r-dz\/CVE-2024-23897\u00a0https:\/\/github.com\/binganao\/CVE-2024-23897. This breach is not just a standalone event but a symptom of a growing trend of attacks on Continuous Integration\/Continuous Deployment (CI\/CD) software supply chains.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/checkmarx.com\/blog\/navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies\/\" \/>\n<meta property=\"og:site_name\" content=\"Checkmarx\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Checkmarx.Source.Code.Analysis\" \/>\n<meta property=\"article:modified_time\" content=\"2025-01-03T08:36:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/CI_CD_blog1-scaled-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1336\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@checkmarx\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/checkmarx.com\/blog\/navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies\/\",\"url\":\"https:\/\/checkmarx.com\/blog\/navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies\/\",\"name\":\"CI\/CD Vulnerabilities: The Jenkins and TeamCity Case Studies\",\"isPartOf\":{\"@id\":\"https:\/\/checkmarx.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/checkmarx.com\/blog\/navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/checkmarx.com\/blog\/navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/CI_CD_blog1-scaled-1.jpg\",\"datePublished\":\"2024-02-06T05:00:00+00:00\",\"dateModified\":\"2025-01-03T08:36:12+00:00\",\"description\":\"Recently, an alarming incident has brought to light a significant vulnerability in Jenkins CI\/CD servers. Approximately\u00a045,000 Jenkins servers have been left exposed to remote code execution (RCE) attacks, leveraging multiple exploit public POCs\u00a0https:\/\/github.com\/h4x0r-dz\/CVE-2024-23897\u00a0https:\/\/github.com\/binganao\/CVE-2024-23897. This breach is not just a standalone event but a symptom of a growing trend of attacks on Continuous Integration\/Continuous Deployment (CI\/CD) software supply chains.\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/checkmarx.com\/blog\/navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/checkmarx.com\/blog\/navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies\/#primaryimage\",\"url\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/CI_CD_blog1-scaled-1.jpg\",\"contentUrl\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/CI_CD_blog1-scaled-1.jpg\",\"width\":2560,\"height\":1336},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/checkmarx.com\/#website\",\"url\":\"https:\/\/checkmarx.com\/\",\"name\":\"Checkmarx\",\"description\":\"The world runs on code. We secure it.\",\"publisher\":{\"@id\":\"https:\/\/checkmarx.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/checkmarx.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/checkmarx.com\/#organization\",\"name\":\"Checkmarx\",\"url\":\"https:\/\/checkmarx.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/checkmarx.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/logo-dark.svg\",\"contentUrl\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/logo-dark.svg\",\"width\":1,\"height\":1,\"caption\":\"Checkmarx\"},\"image\":{\"@id\":\"https:\/\/checkmarx.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/Checkmarx.Source.Code.Analysis\",\"https:\/\/x.com\/checkmarx\",\"https:\/\/www.youtube.com\/user\/CheckmarxResearchLab\",\"https:\/\/www.linkedin.com\/company\/checkmarx\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CI\/CD Vulnerabilities: The Jenkins and TeamCity Case Studies","description":"Recently, an alarming incident has brought to light a significant vulnerability in Jenkins CI\/CD servers. Approximately\u00a045,000 Jenkins servers have been left exposed to remote code execution (RCE) attacks, leveraging multiple exploit public POCs\u00a0https:\/\/github.com\/h4x0r-dz\/CVE-2024-23897\u00a0https:\/\/github.com\/binganao\/CVE-2024-23897. This breach is not just a standalone event but a symptom of a growing trend of attacks on Continuous Integration\/Continuous Deployment (CI\/CD) software supply chains.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/checkmarx.com\/blog\/navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies\/","og_locale":"en_US","og_type":"article","og_title":"CI\/CD Vulnerabilities: The Jenkins and TeamCity Case Studies","og_description":"Recently, an alarming incident has brought to light a significant vulnerability in Jenkins CI\/CD servers. Approximately\u00a045,000 Jenkins servers have been left exposed to remote code execution (RCE) attacks, leveraging multiple exploit public POCs\u00a0https:\/\/github.com\/h4x0r-dz\/CVE-2024-23897\u00a0https:\/\/github.com\/binganao\/CVE-2024-23897. This breach is not just a standalone event but a symptom of a growing trend of attacks on Continuous Integration\/Continuous Deployment (CI\/CD) software supply chains.","og_url":"https:\/\/checkmarx.com\/blog\/navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies\/","og_site_name":"Checkmarx","article_publisher":"https:\/\/www.facebook.com\/Checkmarx.Source.Code.Analysis","article_modified_time":"2025-01-03T08:36:12+00:00","og_image":[{"width":2560,"height":1336,"url":"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/CI_CD_blog1-scaled-1.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_site":"@checkmarx","twitter_misc":{"Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/checkmarx.com\/blog\/navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies\/","url":"https:\/\/checkmarx.com\/blog\/navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies\/","name":"CI\/CD Vulnerabilities: The Jenkins and TeamCity Case Studies","isPartOf":{"@id":"https:\/\/checkmarx.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/checkmarx.com\/blog\/navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies\/#primaryimage"},"image":{"@id":"https:\/\/checkmarx.com\/blog\/navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies\/#primaryimage"},"thumbnailUrl":"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/CI_CD_blog1-scaled-1.jpg","datePublished":"2024-02-06T05:00:00+00:00","dateModified":"2025-01-03T08:36:12+00:00","description":"Recently, an alarming incident has brought to light a significant vulnerability in Jenkins CI\/CD servers. Approximately\u00a045,000 Jenkins servers have been left exposed to remote code execution (RCE) attacks, leveraging multiple exploit public POCs\u00a0https:\/\/github.com\/h4x0r-dz\/CVE-2024-23897\u00a0https:\/\/github.com\/binganao\/CVE-2024-23897. This breach is not just a standalone event but a symptom of a growing trend of attacks on Continuous Integration\/Continuous Deployment (CI\/CD) software supply chains.","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/checkmarx.com\/blog\/navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/checkmarx.com\/blog\/navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies\/#primaryimage","url":"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/CI_CD_blog1-scaled-1.jpg","contentUrl":"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/CI_CD_blog1-scaled-1.jpg","width":2560,"height":1336},{"@type":"WebSite","@id":"https:\/\/checkmarx.com\/#website","url":"https:\/\/checkmarx.com\/","name":"Checkmarx","description":"The world runs on code. We secure it.","publisher":{"@id":"https:\/\/checkmarx.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/checkmarx.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/checkmarx.com\/#organization","name":"Checkmarx","url":"https:\/\/checkmarx.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/checkmarx.com\/#\/schema\/logo\/image\/","url":"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/logo-dark.svg","contentUrl":"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/logo-dark.svg","width":1,"height":1,"caption":"Checkmarx"},"image":{"@id":"https:\/\/checkmarx.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Checkmarx.Source.Code.Analysis","https:\/\/x.com\/checkmarx","https:\/\/www.youtube.com\/user\/CheckmarxResearchLab","https:\/\/www.linkedin.com\/company\/checkmarx"]}]}},"_links":{"self":[{"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/zero-post\/90060","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/zero-post"}],"about":[{"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/types\/zero-post"}],"author":[{"embeddable":true,"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/users\/53"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/media\/90062"}],"wp:attachment":[{"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/media?parent=90060"}],"wp:term":[{"taxonomy":"zero-category","embeddable":true,"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/zero-category?post=90060"},{"taxonomy":"zero-tag","embeddable":true,"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/zero-tag?post=90060"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}