JetBrains TeamCity Authentication Bypass and Remote Code Execution Vulnerability Advisory (CVE-2024-27198)

Affected Vendors

jetbrains

Affected Components

teamcity

Published Date

2024-03-04

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

All JetBrains TeamCity versions prior to 2023.11.4

Impact

Unauthenticated remote attackers can completely bypass authentication mechanisms to gain administrative privileges, leading to full server compromise and arbitrary remote code execution (RCE)

Mitigation

Immediately upgrade TeamCity server to version 2023.11.4 or later, or apply the official security patch plugin

Affected Products & Version Scope

All on-premises installations of JetBrains TeamCity prior to version 2023.11.4

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Apply Official Security Patch

The primary and recommended mitigation is to upgrade your TeamCity server to a secure version.

Target Version: 2023.11.4 or later

2. Temporary Mitigation (If immediate upgrade is not possible)

If you cannot upgrade immediately, you must install the official security patch plugin provided by JetBrains.

How to apply the security plugin:
Download the TeamCity vulnerability mitigation plugin from the official JetBrains security advisory page.
Navigate to Administration -> Plugins in your TeamCity console.
Upload the downloaded plugin ZIP file and enable it.

3. Network and WAF Rules

Configure your Web Application Firewall (WAF) to detect and block suspicious path traversal and unauthorized API requests targeting TeamCity endpoints:

nginx

# Example Nginx/WAF rule to block potential authentication bypass patterns
location ~* /app/rest/.*jsp {
    deny all;
    return 403;
}

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

To prevent complete compromise of your CI/CD pipelines, immediately upgrade exposed TeamCity servers to version 2023.11.4 or later.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

This vulnerability (CVE-2024-27198) is a critical authentication bypass vulnerability (CWE-288) residing within the web-based authentication framework of JetBrains TeamCity.

By exploiting a flaw in how specific HTTP request paths are handled, an unauthenticated attacker can directly access administrative API endpoints. This vulnerability has been assigned a CVSS score of 9.8 (Critical) and is actively exploited in the wild, leading to its inclusion in the CISA KEV (Known Exploited Vulnerabilities) catalog.

Successful exploitation allows attackers to create rogue administrator accounts, manipulate build pipelines, and execute arbitrary commands on the host system, resulting in a complete compromise of the CI/CD infrastructure.