CVE-2020-35667

HIGH
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-35667 has a selected CVSS score of 7.5 (high); EIP currently links 1 repository PoC.

Description

JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

Proofs of concept

1

Repository PoCs

GitHubstefan-500/teamcity-idea-cve-2020-35667-pocRepository PoCby stefan-5000Exploit11 files

657.8 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python Flask server that impersonates a TeamCity XML-RPC endpoint to intercept plaintext credentials from a vulnerable IntelliJ plugin. The server generates an RSA key pair, serves the public key to the client, decrypts the client-supplied encrypted password, and logs the captured username and password.

Backdoor review

No backdoor observed in reviewed code

The PoC implements a fake TeamCity XML-RPC server to demonstrate CVE-2020-35667 credential interception. All code behavior is consistent with the stated purpose: it generates an RSA key, serves it to the client, decrypts the client-supplied encrypted password, and logs the plaintext credentials. No concealed backdoor, persistence, unrelated payload, or operator-directed harm is present.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareJetBrains TeamCity Plugin for IntelliJ IDEA
Attack typesSSRFCredential Interception
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a fully functional server (poc_server.py) that actively impersonates a legitimate TeamCity endpoint to decrypt and capture user credentials. This constitutes an exploit as it exercises the SSRF vulnerability to achieve credential interception, not merely detecting or reporting it.

poc_server.py:1-203README.md:10-17

Requirements

  • Victim must configure the vulnerable TeamCity IntelliJ plugin to connect to the attacker-controlled server URL.README.md:44-45
  • Attacker must run the poc_server.py script, which listens on a specified host and port.poc_server.py:199-203

Observed behavior

  • Starts a Flask web server listening on 127.0.0.1:8888.poc_server.py:199-203
  • Generates a 1024-bit RSA key pair and stores it as rsa.pem if it does not already exist.poc_server.py:70-77
  • Responds to getPublicKey XML-RPC method by returning the RSA public key modulus and exponent as a hex string.poc_server.py:113-123
  • Receives an authenticate XML-RPC request containing a username and an encrypted password hex string.poc_server.py:125-143
  • Decrypts the password using the stored RSA private key and logs the captured plaintext username and password.poc_server.py:160-171
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Capture
Server decrypts and logs plaintext username and password from clientThis is the core PoC demonstration of the SSRF vulnerability; it is expected behavior for a credential interception proof-of-concept.poc_server.py:160-171
Key Generation
RSA key pair generated and stored locally as rsa.pemThe server creates a key pair to mimic the legitimate TeamCity server's public key exchange, enabling decryption of the intercepted password.poc_server.py:70-77
Review boundaries

What the analysis did not establish

  • Evidence does not include the content of REPORT.md or ANALYSIS.md files, which are referenced in README.md but not provided in the selected text.
  • The artifact's non-text media files (4 files, 619918 bytes) were not analyzed; their content is unknown.
  • The analysis is based solely on the provided source code and documentation; no dynamic execution or verification was performed.
  • Four non-text media files (619918 bytes) and four unclassified files (42917 bytes) were present in the repository but not analyzed; their content is unknown.
  • The review is limited to static analysis of the provided source code; no dynamic execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3