JetBrains TeamCity Path Traversal and Authentication Bypass Vulnerability (CVE-2024-27199) Analysis and Mitigation Guide

Affected Vendors

jetbrains

Affected Components

teamcity

Published Date

2024-03-04

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

JetBrains TeamCity on-premises servers prior to version 2023.11.4

Impact

Unauthenticated attackers can bypass authentication via path traversal, allowing them to perform limited administrative actions (e.g., modifying system configurations, creating rogue accounts)

Mitigation

Immediately upgrade TeamCity to version 2023.11.4 or later, or apply the official security patch plugin

Affected Products & Version Scope

All JetBrains TeamCity on-premises versions prior to 2023.11.4

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Security Patch (Recommended)

Upgrade your TeamCity server to version 2023.11.4 or later.

2. Temporary Mitigation (If immediate upgrade is not possible)

If you cannot upgrade immediately, download and install the official security patch plugin provided by JetBrains.

3. WAF (Web Application Firewall) Rules

Deploy WAF rules to detect and block path traversal patterns targeting TeamCity endpoints:

nginx

# Example Nginx/WAF rule to block path traversal attempts
if ($request_uri ~* "(\.\./|\.\.\\|/res/|/update/)_?jsp") {
    return 403;
}

4. Indicators of Compromise (IoC) Hunting

Inspect TeamCity logs (teamcity-auth.log and teamcity-activities.log) for unauthorized administrative actions or unexpected user creation events originating from external IP addresses.

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

As this vulnerability is actively exploited in the wild (CISA KEV), immediately upgrade to version 2023.11.4 or apply the official mitigation plugin.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

This vulnerability (CVE-2024-27199) is a path traversal vulnerability (CWE-22/CWE-23) residing in the web request handling component of JetBrains TeamCity.

By crafting malicious URI segments containing path traversal sequences (such as /res/../ or manipulating JSP parameters), an unauthenticated attacker can bypass the security filter chain. While similar to the critical CVE-2024-27198 vulnerability, CVE-2024-27199 allows access to a different set of endpoints, enabling limited but highly impactful administrative actions, including system configuration modification and user account creation.

This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog. With an EPSS score of 0.94, mass exploitation attempts are highly prevalent, making immediate remediation critical.