Loading vulnerability…
Authentication Bypass in JetBrains TeamCity On-Premises
CVE-2024-27198 is a critical authentication bypass vulnerability in the web component of JetBrains TeamCity On-Premises versions before 2023.11.4. Improper request handling in the jetbrains.buildServer.controllers.BaseController class permits an alternate execution path to protected endpoints without authentication. Specially crafted requests manipulate URL parameters and error-response handling to bypass authentication checks. Successful exploitation enables administrative actions and can lead to remote code execution. The vulnerability has a CVSS v3.1 score of 9.8 and is actively exploited.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality, integrity, and availability of the TeamCity server. Attackers can obtain administrative control, create administrator accounts or access tokens, and execute commands under the TeamCity service account. Control of projects, builds, agents, and artifacts creates opportunities to steal sensitive information, manipulate build processes, and compromise downstream software delivery. Observed exploitation has included ransomware, cryptocurrency miners, and remote-access backdoors.
If you can’t patch tonight, do this now.
Restrict HTTP(S) access to TeamCity to trusted networks and authorized users while remediation is pending. Monitor for authentication-bypass request patterns, unexpected administrator accounts or tokens, unauthorized plugins or webshells, and command shells spawned by the TeamCity Java process. Network restrictions and monitoring reduce exposure but do not replace applying the vendor fix.
Patch, then assume compromise.
Upgrade TeamCity On-Premises to version 2023.11.4 or a later fixed release. JetBrains released the fix on March 4, 2024. Organizations unable to upgrade immediately can install the official security-patch plugin addressing this vulnerability, selecting the package appropriate to their TeamCity version. TeamCity Cloud instances were patched automatically.
14 exploits validated by Mallory's analysis. Hidden: 6 rejected by Mallory's analysis as not a working exploit; 3 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
59 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.