JetBrains TeamCity On-Premises Unauthenticated RCE via Agent Polling Protocol XStream Deserialization

#!/usr/bin/env bash
# check_cve_2026_63077.sh — Check JetBrains TeamCity for CVE-2026-63077
# Usage: bash check_cve_2026_63077.sh <TEAMCITY_BASE_URL>
# Example: bash check_cve_2026_63077.sh https://teamcity.example.com:8111
# Requires: curl, no authentication needed
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <TEAMCITY_BASE_URL>"
  echo "Example: $0 https://teamcity.example.com:8111"
  exit 2
fi

BASE_URL="${1%/}"

# Fetch server version via REST API (unauthenticated endpoint)
VERSION_JSON=$(curl -sSf -k --max-time 10 "${BASE_URL}/app/rest/server" -H "Accept: application/json" 2>/dev/null) || {
  echo "UNKNOWN — Could not connect to TeamCity at ${BASE_URL}"
  exit 2
}

# Extract version and build number
VERSION=$(echo "$VERSION_JSON" | grep -oP '"version"\s*:\s*"\K[^"]+' 2>/dev/null || echo "")
BUILD=$(echo "$VERSION_JSON" | grep -oP '"buildNumber"\s*:\s*"\K[^"]+' 2>/dev/null || echo "")

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — Could not parse TeamCity version from response"
  exit 2
fi

echo "Detected TeamCity version: ${VERSION} (build ${BUILD})"

# Parse major.minor.patch from version string
# Fixed versions: 2025.11.7 and 2026.1.3
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

# Default patch to 0 if not present
PATCH=${PATCH:-0}

# Check if version is patched
if [ "$MAJOR" -gt 2026 ] 2>/dev/null; then
  echo "PATCHED — Version ${VERSION} is newer than all affected versions"
  exit 0
elif [ "$MAJOR" -eq 2026 ]; then
  if [ "$MINOR" -gt 1 ] 2>/dev/null; then
    echo "PATCHED — Version ${VERSION} is newer than fixed version 2026.1.3"
    exit 0
  elif [ "$MINOR" -eq 1 ] && [ "$PATCH" -ge 3 ] 2>/dev/null; then
    echo "PATCHED — Version ${VERSION} includes the fix (>= 2026.1.3)"
    exit 0
  else
    echo "VULNERABLE — Version ${VERSION} is affected by CVE-2026-63077 (needs >= 2026.1.3)"
    exit 1
  fi
elif [ "$MAJOR" -eq 2025 ]; then
  if [ "$MINOR" -gt 11 ] 2>/dev/null; then
    echo "PATCHED — Version ${VERSION} is newer than fixed version 2025.11.7"
    exit 0
  elif [ "$MINOR" -eq 11 ] && [ "$PATCH" -ge 7 ] 2>/dev/null; then
    echo "PATCHED — Version ${VERSION} includes the fix (>= 2025.11.7)"
    exit 0
  else
    echo "VULNERABLE — Version ${VERSION} is affected by CVE-2026-63077 (needs >= 2025.11.7)"
    exit 1
  fi
else
  # All versions prior to 2025.x are vulnerable
  echo "VULNERABLE — Version ${VERSION} is affected by CVE-2026-63077 (all versions before 2025.11.7 are vulnerable)"
  exit 1
fi