CVE-2024-27198

What it actually does

CVE-2024-27198 is a critical, remotely exploitable authentication bypass in JetBrains TeamCity versions before 2023.11.4. A specially crafted HTTP request can bypass TeamCity’s normal authentication and authorization checks and reach authenticated REST/API functionality as if the attacker were a privileged user. In practice, this can allow unauthenticated attackers to create administrator access tokens, create or modify administrative users, change server configuration, access build secrets, and upload malicious plugins or build steps that lead to arbitrary code execution on the TeamCity server and potentially connected build agents.

Why it matters to the business

A compromised TeamCity server can give attackers control over software build and deployment pipelines. This can expose source code, credentials, signing keys, CI/CD secrets, artifact repositories, and deployment tokens, and may allow attackers to tamper with released software or pivot into production and cloud environments. The vulnerability is listed in CISA KEV, has active in-the-wild exploitation, an extremely high EPSS score, and has been associated with ransomware activity, so unpatched internet-facing TeamCity instances should be treated as high-priority incident-response candidates, not just routine patching work.

How an attack unfolds

An attacker scans for exposed JetBrains TeamCity servers and identifies a vulnerable version earlier than 2023.11.4. The attacker sends crafted HTTP requests that abuse the authentication bypass to access normally protected TeamCity REST endpoints without valid credentials. Common abuse patterns include creating a new administrator account, generating an authentication token for an existing administrator, or modifying server settings. With administrative access, the attacker can inspect projects and build configurations, retrieve stored credentials and tokens, alter build steps, upload a malicious TeamCity plugin, or trigger builds that execute attacker-controlled commands. After gaining execution or credential access, the attacker may establish persistence, exfiltrate source code and secrets, tamper with artifacts, move laterally using CI/CD credentials, or deploy ransomware.

How to fix it

Upgrade JetBrains TeamCity to version 2023.11.4 or later immediately. If immediate upgrade is not possible, remove TeamCity from direct internet exposure, restrict access to trusted VPN or management networks, and apply any JetBrains-provided temporary security patches or mitigations for affected versions. Rotate credentials that may be stored in or accessible through TeamCity, including VCS credentials, deployment tokens, cloud keys, artifact repository credentials, signing keys, and service account passwords. Review and remove unauthorized users, access tokens, plugins, build steps, webhooks, projects, and agent registrations. Because this vulnerability has been exploited in the wild and is associated with ransomware campaigns, any exposed vulnerable instance should be investigated for compromise even after patching.

How to confirm the fix worked

Confirm the running TeamCity version is 2023.11.4 or later from the TeamCity administration interface, server startup logs, or installed application metadata. Verify that unauthenticated requests to protected REST endpoints return authentication failures and do not create users, tokens, or modify configuration. Review access controls to ensure TeamCity is not publicly reachable unless explicitly required and protected by compensating controls. Validate that no unexpected administrator accounts, access tokens, plugins, build configurations, service messages, or build agent registrations exist. After upgrade, run an authenticated administrative review and, where appropriate, an external vulnerability scan to confirm the instance is no longer detected as vulnerable.

Typical attack path

1. Discover an exposed JetBrains TeamCity web interface, commonly on ports 80, 443, or 8111.
2. Confirm the server is running a vulnerable TeamCity version before 2023.11.4 or probe for bypass behavior using crafted unauthenticated requests.
3. Send a crafted request to a protected REST/API endpoint using the authentication bypass pattern.
4. Create an administrator user or generate an access token for an existing administrative account.
5. Authenticate with the newly created account or token and access TeamCity administration features.
6. Extract sensitive data such as build parameters, VCS credentials, deployment keys, environment variables, and stored secrets.
7. Upload a malicious plugin, alter build configurations, or trigger attacker-controlled build steps to execute code.
8. Use stolen credentials or CI/CD access to pivot into source control, artifact repositories, cloud accounts, deployment systems, or production networks.
9. Maintain persistence through added users, tokens, plugins, scheduled build steps, or modified project settings.
10. Optionally stage data theft, software supply-chain tampering, cryptomining, or ransomware deployment.

How to detect it

Review reverse proxy, load balancer, WAF, and TeamCity access logs for unauthenticated or suspicious requests to REST/API endpoints, especially requests containing path parameters such as ';.jsp' or attempts to create users or tokens. Examine TeamCity server and audit logs for unexpected administrator account creation, token creation, login activity, plugin upload, project configuration changes, build step modifications, agent registration, and settings changes around and after the first public exploitation window in March 2024. Look for accounts or tokens created from unusual IP addresses, outside normal administration windows, or with names that do not match standard identity processes. Inspect the TeamCity plugins directory and data directory for recently added or modified plugin archives, unexpected JAR files, webshell-like content, or files owned by the TeamCity process. Review build history for suspicious commands such as credential dumping, shell download cradles, reverse shells, cryptominer deployment, ransomware staging, archive-and-exfiltration activity, or unusual outbound network connections from the TeamCity server or build agents. Correlate TeamCity activity with EDR telemetry for child processes spawned by the TeamCity server or build agent processes, especially shells, scripting engines, network download utilities, compression tools, and credential-access tooling.

• ;.jsp
• /app/rest/users;.jsp
• /app/rest/users/id:1/tokens
• /app/rest/users/id:1/tokens/
• /app/rest/users/id:1/tokens/RPC2
• /app/rest/users/id:1/tokens/RPC2;.jsp
• /app/rest/users/id:1/tokens/.*;.jsp
• POST /app/rest/users
• POST /app/rest/users;
• POST /app/rest/users/id:1/tokens
• POST /app/rest/users/id:1/tokens/RPC2
• Authorization: Bearer
• SYSTEM_ADMIN
• Authentication token
• token created
• User created
• Created user
• Plugin uploaded
• Upload plugin
• /admin/plugins.html
• /admin/admin.html
• /plugins/
• <TeamCity Data Directory>/plugins
• <TeamCity Data Directory>/system/caches/plugins
• <TeamCity Data Directory>/config/projects
• teamcity-server.log
• teamcity-activities.log
• teamcity-audit.log
• teamcity-vcs.log
• java.lang.ProcessBuilder
• cmd.exe /c
• powershell.exe
• pwsh.exe
• /bin/sh -c
• /bin/bash -c
• curl http
• wget http
• Invoke-WebRequest
• Invoke-Expression
• certutil -urlcache
• bitsadmin /transfer
• rundll32.exe
• regsvr32.exe
• xmrig
• mimikatz

What your security team should do

• Treat any internet-exposed TeamCity server running a version before 2023.11.4 as potentially compromised and start incident response before or alongside remediation.
• Upgrade all TeamCity servers to 2023.11.4 or later immediately; this vulnerability is in CISA KEV, has active exploitation, and has been associated with ransomware activity.
• If upgrade cannot be completed immediately, block external access to TeamCity and restrict access to trusted administrative networks or VPN only.
• Hunt for exploitation in HTTP access logs, TeamCity server logs, audit logs, user/token records, plugin directories, and build configuration history.
• Review and remove unauthorized administrator accounts, authentication tokens, plugins, build steps, agent registrations, and project changes.
• Rotate all secrets accessible to TeamCity, prioritizing VCS, artifact repository, cloud, deployment, package registry, signing, and service account credentials.
• Audit recent builds for unexpected commands, modified build steps, suspicious artifacts, unusual outbound network connections, and secret exposure.
• Check connected build agents for persistence, malware, credential theft, and unauthorized tooling because attackers may use TeamCity to execute commands on agents.
• Increase monitoring for TeamCity administrative actions, token creation, plugin uploads, and unusual REST API calls.
• Preserve relevant logs and forensic artifacts before rebuilding or cleaning systems if compromise is suspected.