Critical TeamCity Authentication Bypass Exploited in Server Compromises

Attackers exploited authentication-bypass vulnerabilities in JetBrains TeamCity On-Premises, with JetBrains reporting customer compromises involving ransomware, unauthorized administrator accounts, and suspected preparation for DDoS attacks. The critical flaw, CVE-2024-27198, affects versions before 2023.11.4 and allows unauthenticated attackers to perform administrative actions, potentially compromising the server and its host environment. It carries a CVSS v3.1 score of 9.8 and is listed in CISA’s Known Exploited Vulnerabilities catalog. Rapid7 reported it and the related authentication-bypass flaw CVE-2024-27199 to JetBrains on February 20, 2024.

JetBrains released TeamCity 2023.11.4 and a separate security patch on March 4, 2024. According to JetBrains, Rapid7 published detailed exploitation instructions approximately five hours later and subsequently released an exploit module; public exploitation resources include a Metasploit module and a GitHub proof of concept. JetBrains argued that detailed disclosure should have been delayed to give customers time to patch, but its attribution of customer compromises to Rapid7’s publication is not independently established by the supplied reporting. Organizations running affected installations should prioritize upgrading to the latest supported TeamCity release and investigate unauthorized administrator accounts and other signs of compromise; patching alone does not resolve an existing intrusion.