stefan-500/teamcity-idea-cve-2020-35667-pocTeamCity IntelliJ IDEA Plugin Credential Interception
Proof-of-Concept Report | Workflow Analysis | Server script
This is a reproduction of CVE-2020-35667 by building a fake XML-RPC TeamCity endpoint.
CVE-2020-35667 is a SSRF vulnerability in the JetBrains TeamCity Plugin for IntelliJ IDE.
The old TeamCity IntelliJ plugin requests a public key from the server, encrypts the password with it, and sends it back.
Since the server is attacker-controlled, the attacker decrypts and logs the plaintext credentials.
The vulnerability was reported by Jonathan Leitschuh (https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/).
The impact of exploiting this vulnerability is the Interception of plaintext user credentials during plugin login process, via attacker controlled XML-RPC endpoint.
This is my setup for reproducing the issue:
IntelliJ IDEA Community Edition 2018.1.8
TeamCity 2020.2.1 (build 85633)
Vulnerable TeamCity IntelliJ Plugin
TeamCity-IDEAplugin.zip;98aaaea4276f718c6c9cf3cb5383da1be6af9daa29e5b17fda8fa70d6bc1342fOS: Windows 10
Python version: 3.12.7
Python requirements are located in cve2020-35667/requirements.txt
pip install -r requirements.txt
python poc_server.py
# Server listens on http://127.0.0.1:8888
http://127.0.0.1:8888.Expected result (vulnerable): User credentials are logged to the server console.
Expected behavior if secure: Client validates server identity and key authenticity, credentials are not exposed to a spoofed endpoint.