Merge pull request #4628 from Ph33rr/master

misconfig in teamcity add 2 temp

misconfiguration/teamcity/teamcity-guest-login-enabled.yaml

@@ -0,0 +1,38 @@
+id: teamcity-guest-login-enabled
+
+info:
+  name: JetBrains TeamCity - Guest User Access Enabled
+  author: Ph33r
+  severity: info
+  description: |
+    TeamCity provides the ability to turn on the guest login allowing anonymous access to the TeamCity UI.
+  reference:
+    - https://ph33r.medium.com/misconfig-in-teamcity-panel-lead-to-auth-bypass-in-apache-org-exploit-146f6a1a4e2b
+    - https://www.jetbrains.com/help/teamcity/guest-user.html
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 7.30
+    cwe-id: CWE-200
+  metadata:
+    verified: true
+    shodan-query: http.component:"TeamCity"
+  tags: misconfig,teamcity,jetbrains
+
+requests:
+  - raw:
+      - |
+        GET /guestLogin.html?guest=1 HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - 'Location: /overview.html'
+          - 'TCSESSIONID='
+        condition: and
+
+      - type: status
+        status:
+          - 302

misconfiguration/teamcity/teamcity-registration-enabled.yaml

@@ -0,0 +1,31 @@
+id: teamcity-registration-enabled
+
+info:
+  name: JetBrains TeamCity - Registration Enabled
+  author: Ph33r
+  severity: high
+  description: |
+    JetBrains - TeamCity -  register User Allow
+  reference:
+    - https://ph33r.medium.com/misconfig-in-teamcity-panel-lead-to-auth-bypass-in-apache-org-0day-146f6a1a4e2b
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 7.30
+    cwe-id: CWE-200
+  metadata:
+    verified: true
+    shodan-query: http.component:"TeamCity"
+  tags: misconfig,auth-bypass,teamcity,jetbrains
+
+requests:
+  - raw:
+      - |
+        GET /registerUser.html?init=1 HTTP/1.1
+        Host: {{Hostname}}
+
+    redirects: true
+    max-redirects: 2
+    matchers:
+      - type: word
+        words:
+          - '<title>Register a New User Account &mdash; TeamCity</title>'