Hosts, IPs, or URLs, one per line. Empty input uses localhost.
Detect
Fingerprints TeamCity and flags CVE-2023-42793 by version. No probe.
Confirm
GET /app/rest/users/id:1/tokens/RPC2. No token write.
Collect
Merges per-host detect and confirm rows.
Report
Counts checked, product, affected, and confirmed.
Overview
This workflow finds JetBrains TeamCity and sorts each host by whether its version falls in the CVE-2023-42793 range. CVE-2023-42793 is unauthenticated admin token creation. CISA listed it on KEV after confirmed use. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from the public page, reads the version, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. Version flag is first. Hosts in range get a second node that GETs /app/rest/users/id:1/tokens/RPC2 with no body. It does not create a token. Same honesty as the TeamCity 27198 REST GET.
Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
Fingerprint each host as TeamCity, then read the version and compare it to the CVE-2023-42793 floors in the graph.
Confirm only those flagged hosts with an unauthenticated GET of /app/rest/users/id:1/tokens/RPC2. It does not create a token.
Collect the per-host rows: product match, version, affected flag, confirmed flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, affected, confirmed, and errors.
Inputs
Target list. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a url field also works. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether TeamCity was detected, the version read, the affected flag, and whether the REST token path answered without a write.
summary.json. Counts across the list: targets, product hits, affected, confirmed, and errors.
Integrations
HTTP. Unauthenticated GET to the product login page and, on flagged hosts only, /app/rest/users/id:1/tokens/RPC2 with no body. No token write.
Sample output
The records below are illustrative and do not come from a real run. They show one TeamCity host inside the CVE-2023-42793 range, one patched host, and one host that is not the product.
TeamCity before 2023.05.4. 2023.05.4 is the floor. The compare uses the version the product itself served.
Does a confirmed row mean a token was created?
No. Confirm only GETs /app/rest/users/id:1/tokens/RPC2 with no body. It does not create a token. A confirmed row means the REST token path still answers.
Is this check safe on production?
Yes. Fingerprint is read-only GET. Confirm is an unauthenticated GET of the token path, only on hosts already in range. It does not log in or write a token.
Does the check need credentials?
No. It fingerprints the public page the way an external scanner would.
What is CVE-2023-42793?
Unauthenticated admin token creation on TeamCity. CISA listed it on KEV after confirmed use. This workflow flags by version, then confirms the REST token path without a write.