CVE-2024-27199

What it actually does

This vulnerability is a network-exploitable path traversal flaw in JetBrains TeamCity before version 2023.11.4. An unauthenticated attacker can manipulate URL paths to reach internal TeamCity functionality that should not be directly exposed, enabling limited administrative actions without valid credentials. The impact is lower than full remote code execution by itself, but because TeamCity commonly stores build secrets, source-control integrations, deployment credentials, signing material, and automation tokens, even limited administrative access can enable credential theft, CI/CD pipeline manipulation, and follow-on compromise of connected systems.

Why it matters to the business

A compromised TeamCity server can become a high-value entry point into software delivery pipelines. Attackers may steal source code, harvest deployment or cloud credentials, tamper with builds, create backdoored artifacts, or disrupt release operations. This issue is listed in CISA KEV, has extremely high EPSS likelihood, is known to be actively exploited in the wild, and is associated with ransomware activity, so exposed or unpatched TeamCity instances should be treated as urgent remediation priorities. Organizations using TeamCity in internet-facing or partner-accessible roles face increased risk of supply-chain compromise and operational disruption.

How an attack unfolds

An attacker scans for reachable JetBrains TeamCity servers and identifies instances running a vulnerable version before 2023.11.4. The attacker sends crafted HTTP requests containing path traversal sequences that cause TeamCity to route the request to restricted administrative endpoints or actions that should require authentication. If successful, the attacker performs limited administrative operations, which may include changing configuration, creating or modifying access paths, interacting with project or build settings, or obtaining information useful for deeper access. From there, the attacker may enumerate users, projects, build configurations, VCS roots, tokens, artifacts, and secrets exposed through TeamCity. In real-world intrusions, this type of foothold is often used to compromise CI/CD credentials, modify build pipelines, stage malicious artifacts, or support ransomware deployment through connected infrastructure.

How to fix it

Upgrade JetBrains TeamCity to version 2023.11.4 or later immediately. If immediate upgrade is not possible, remove public internet exposure, restrict access to trusted VPN or administrative networks, place TeamCity behind strong authentication and allowlisting controls, and monitor closely until patched. Rotate secrets that may have been accessible through TeamCity, including VCS credentials, deployment keys, cloud tokens, package registry credentials, signing keys, and service-account tokens. Review TeamCity users, access tokens, projects, build configurations, VCS roots, plugins, build steps, artifact dependencies, and recent administrative changes for unauthorized modifications. Because this vulnerability is in CISA KEV and associated with ransomware activity, remediation should include compromise assessment, not just patching.

How to confirm the fix worked

Confirm the TeamCity server reports version 2023.11.4 or later from the administrative UI, server startup logs, package inventory, container image tags, or deployment manifests. Verify that unauthenticated requests cannot reach restricted administrative endpoints through crafted traversal-style paths. Confirm internet exposure has been removed or restricted where applicable. Review reverse-proxy, WAF, and TeamCity access logs for suspicious traversal patterns and unexpected unauthenticated access to administrative routes. Validate that all TeamCity access tokens and sensitive integrations have been reviewed or rotated and that no unauthorized users, plugins, build steps, or VCS roots remain.

Typical attack path

1. Discover internet-facing or otherwise reachable JetBrains TeamCity web interfaces.
2. Fingerprint the TeamCity version or behavior to determine whether it is older than 2023.11.4.
3. Send crafted HTTP requests using relative path traversal to access restricted TeamCity administrative functionality without authentication.
4. Perform limited administrative actions or enumerate sensitive TeamCity configuration and project data.
5. Harvest credentials, tokens, VCS integration details, build parameters, artifacts, or deployment secrets available through TeamCity.
6. Modify build configurations, users, tokens, plugins, or automation settings where access permits.
7. Use stolen credentials or altered CI/CD workflows to pivot into source control, artifact repositories, cloud environments, deployment targets, or internal systems.
8. Cover tracks by deleting or altering TeamCity logs, build history, users, tokens, or suspicious configuration changes.

How to detect it

Review TeamCity access logs, reverse-proxy logs, load-balancer logs, WAF alerts, and EDR telemetry on the TeamCity host for unauthenticated requests containing relative path traversal patterns, especially requests that return successful status codes and are followed by administrative actions. Examine TeamCity server logs, audit logs, authentication logs, and build history for newly created users, unexpected access tokens, modified permissions, changed project settings, altered VCS roots, new or modified build steps, added plugins, suspicious artifact changes, and unusual administrative activity from unfamiliar IP addresses. Correlate any suspicious TeamCity activity with downstream access from TeamCity service accounts to source control, cloud providers, artifact repositories, package registries, deployment systems, and endpoint management tools. Because exploitation has been observed in the wild and ransomware campaigns have used TeamCity weaknesses, also look for post-exploitation behaviors such as credential dumping, outbound connections to unfamiliar infrastructure, archive creation, web shells or dropped tooling on the TeamCity server, abnormal process execution by the TeamCity service account, and mass access to build artifacts or secrets.

• ../
• ..%2f
• ..%2F
• %2e%2e%2f
• %2e%2e/
• %252e%252e%252f
• /.%2e/
• /..;/
• /admin/
• /app/
• /app/rest/
• /app/rest/users
• /app/rest/users/id:1/tokens
• /app/rest/server
• /app/rest/projects
• /app/rest/buildTypes
• /app/rest/vcs-roots
• TeamCity-Server-Log
• teamcity-server.log
• teamcity-activities.log
• teamcity-auth.log
• teamcity-audit.log
• Catalina.out
• Tomcat localhost_access_log
• Unexpected user creation
• Access token created
• Access token deleted
• User account created
• User account updated
• Permissions changed
• VCS root updated
• Build configuration changed
• Plugin uploaded
• plugin uploaded
• unauthorized admin action

What your security team should do

• Prioritize patching all JetBrains TeamCity servers to 2023.11.4 or later, especially internet-facing systems.
• Treat any vulnerable internet-exposed TeamCity instance as potentially compromised and initiate incident response triage.
• Search historical web, reverse-proxy, WAF, and TeamCity logs for traversal attempts and unauthorized administrative access.
• Rotate CI/CD-related credentials and secrets stored in or used by TeamCity, including source-control, cloud, deployment, signing, and package-registry credentials.
• Review TeamCity users, groups, permissions, access tokens, build configurations, VCS roots, plugins, artifacts, and audit logs for unauthorized changes.
• Restrict TeamCity access to trusted networks or VPN and enforce SSO/MFA for administrative users where supported.
• Inspect recent builds and produced artifacts for unauthorized steps, suspicious scripts, unexpected dependencies, or tampering.
• Monitor for follow-on activity from TeamCity service accounts in source control, cloud providers, artifact repositories, and deployment platforms.
• Apply heightened urgency because the vulnerability is actively exploited, appears in CISA KEV, has very high EPSS probability, and is associated with ransomware activity.