teamcity-registration-enabled: JetBrains TeamCity - Registration Enabled

id: teamcity-registration-enabled

info:
  name: JetBrains TeamCity - Registration Enabled
  author: Ph33r
  severity: high
  description: |
    JetBrains TeamCity allows all visitors to register due to a misconfiguration.
  reference:
    - https://ph33r.medium.com/misconfig-in-teamcity-panel-lead-to-auth-bypass-in-apache-org-0day-146f6a1a4e2b
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 7.3
    cwe-id: CWE-200
    cpe: cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.component:"TeamCity"
    product: teamcity
    vendor: jetbrains
  tags: misconfig,auth-bypass,teamcity,jetbrains,intrusive,vuln

http:
  - raw:
      - |
        GET /registerUser.html?init=1 HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: word
        words:
          - '<title>Register a New User Account ? TeamCity</title>'
# digest: 4a0a00473045022100faf78d897fc0ebda9a38d0a67245c6740663acf3718731f82887f5c2357424d602200e5a0e70c378ad38fd0f6725fae325827447a4deb7191689dafaf3e84234a883:922c64590222798bb761d5b6d8e72950