Behind enemy lines: bug hunting with Burp Infiltrator
Summary: PortSwigger researcher Santiago Díaz used Burp Infiltrator, which instruments target applications to trace user input to dangerous sinks, to find a 0day in JetBrains' TeamCity continuous integration server. The flaw let a crafted repository URL write arbitrary properties into a Git configuration file, enabling code execution, backdoor insertion, or forced fetching of arbitrary code; JetBrains patched it in version 2017.1.2 on June 2 alongside a clickjacking issue.
Bottom line: A single repository URL field on a CI server was enough to reach properties like core.sshCommand and gpg.program, meaning an attacker could run code or plant backdoors on behalf of a legitimate developer. The patch landed in 2017.1.2 on June 2, so any TeamCity instance still behind that build carries the exposure.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026