## https://sploitus.com/exploit?id=643404F5-DEAA-54B1-B676-B3B0F613C8FE
# CI/CD Tool CVE Vulnerability Reproduction Testbed
## Disclaimer
> **This project is intended solely for security education and authorized testing purposes.**
>
> All vulnerability reproduction environments run in isolated Docker containers. It is strictly prohibited to use the technologies in this project on unauthorized systems. Users assume all legal liability.
## Why Focus on CI/CD Security?
CI/CD tools (Jenkins, TeamCity, GitLab CI, GitHub Actions, etc.) are core infrastructure components of modern software development. They are **high-value attack targets** for the following reasons:
1. **Access to source code** — CI/CD systems need to pull and build code, giving them full access to code repositories
2. **Storage of large amounts of credentials** — Deployment keys, API tokens, database passwords, cloud service credentials, and more are stored within CI/CD systems
3. **Deployment Permissions** — They can directly deploy code to production environments
4. **Core of the Trust Chain** — Once a CI/CD system is compromised, attackers can inject malicious code during the build process (supply chain attacks)
## List of Vulnerabilities
| CVE ID | Tool | Vulnerability Type | CVSS | Recommendation | Difficulty |
|---------|------|---------|------|------|------|
| [CVE-2024-23897](./CVE-2024-23897/) | Jenkins | Arbitrary file read via CLI | 9.8 | ⭐⭐⭐ | Easy |
| [CVE-2023-42793](./CVE-2023-42793/) | TeamCity | Authentication Bypass + RCE | 9.8 | ⭐⭐ | Easy |
| [CVE-2024-27198](./CVE-2024-27198/) | TeamCity | Authentication Bypass | 9.8 | ⭐ | Moderate |
| [CVE-2024-27199](./CVE-2024-27199/) | TeamCity | Path Traversal + Authentication Bypass | 7.3 | ⭐ | Easy |
## Environment Requirements
- Docker and Docker Compose
- curl
- Java (optional for some PoCs; the script will automatically execute an alternative via Docker)
- At least 4GB of available memory (TeamCity requires a significant amount of memory)
## Quick Start
```bash
# 1. Navigate to a CVE directory
cd CVE-2024-23897
# 2. Start the target environment
docker compose up -d
# 3. Wait for the service to start, then run the PoC
./poc.sh
# 4. Clean up the environment when finished
docker compose down
```
## Recommended Learning Path
### Phase 1: Getting Started (Jenkins)
1. **CVE-2024-23897** (⭐⭐⭐ Highly Recommended)
- The most straightforward vulnerability with a clear mechanism
- Key learning points: Abuse of third-party library features; attack chain: file reading → credential theft → RCE
### Phase 2: Authentication Bypass (TeamCity)
2. **CVE-2023-42793** (⭐⭐ Recommended)
- Classic path-traversal authentication bypass
- Key learning points: How differences in path handling across web frameworks lead to security issues
3. **CVE-2024-27198** + **CVE-2024-27199** (Recommended to study together)
- Two related vulnerabilities in the same version
- Key Takeaways: Security implications of alternative path handling mechanisms; comparison of vulnerabilities with different severity levels
## Important Notes
- Jenkins takes **1–2 minutes** to start
- TeamCity takes **2–3 minutes** to start, and you may need to accept the license agreement on first launch
- It is recommended to allocate at least **2GB of memory** for TeamCity
- Multiple TeamCity test environments use the same port **8111**; please avoid running them simultaneously
## Reference Resources
- [OWASP CI/CD Security Top 10](https://owasp.org/www-project-top-10-ci-cd-security-risks/)
- [Jenkins Security Advisories](https://www.jenkins.io/security/advisories/)
- [JetBrains Security Bulletins](https://www.jetbrains.com/privacy-security/issues-fixed/)