CVE-2024-27198
JetBrains TeamCity Authentication Bypass Vulnerability
Description
CVE-2024-27198 is a critical authentication bypass vulnerability in JetBrains TeamCity, a widely used continuous integration and delivery (CI/CD) platform. Affecting versions before 2023.11.4, this vulnerability allows unauthenticated remote attackers to perform administrative actions without valid credentials, exploiting a flaw classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). Successful exploitation gives attackers full control over TeamCity servers, enabling them to steal source code, inject malicious code into build pipelines, and compromise software supply chains. CVE-2024-27198 has been confirmed in active exploitation, added to CISA's Known Exploited Vulnerabilities (KEV) catalog with a ransomware association, and carries an EPSS score of 0.946 — placing it in the 100th percentile of exploitability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| jetbrains | teamcity | < 2023.11.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive(Press/Media Coverage, Third Party Advisory)
- https://www.jetbrains.com/privacy-security/issues-fixed/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27198(US Government Resource)
Weakness Type
CWE-288: Authentication Bypass Using an Alternate Path or Channel
CWE-288 describes a weakness where a product authenticates users through a primary channel but fails to guard equivalent functionality accessible via an alternate path. In CVE-2024-27198, attackers were able to invoke admin-level API endpoints in JetBrains TeamCity by circumventing the normal authentication mechanism, effectively accessing administrative functionality without ever presenting valid credentials.
Learn more: CWE-288 — Authentication Bypass Using an Alternate Path or Channel
Impact Analysis
CVE-2024-27198 carries a CVSS 3.1 base score of 9.8 (CRITICAL), reflecting the maximum impact across all three security domains. Confidentiality is fully compromised: an unauthenticated attacker gains unrestricted access to all project configurations, build artifacts, secrets, environment variables, and source code repositories integrated with TeamCity. Integrity is equally devastated — with admin-level control, attackers can modify build scripts, inject malicious payloads into CI/CD pipelines, and tamper with build outputs distributed to downstream users or customers, effectively turning TeamCity into a software supply chain attack vector. Availability is also fully impacted, as attackers can shut down build agents, delete projects, or render the entire TeamCity installation inoperable.
The attack vector is network-based with no complexity, no privileges required, and no user interaction needed, meaning exploitation is straightforward for any adversary with network access to a vulnerable TeamCity instance. The scope remains unchanged, limiting the formal CVSS spread, but in practice the downstream consequences — corrupted builds, compromised developer credentials, and supply chain attacks — extend far beyond the TeamCity server itself. Mass exploitation campaigns were observed in the wild shortly after public disclosure, with threat actors creating rogue administrative accounts to maintain persistent access.
Exploit Maturity
CVE-2024-27198 is one of the most actively exploited vulnerabilities of 2024. With an EPSS score of 0.946 and an EPSS percentile of 1.0 (100th percentile), it ranks among the most likely-to-be-exploited CVEs in the entire NVD database at the time of scoring. CISA added this vulnerability to its KEV catalog with a remediation deadline of March 28, 2024 — just days after public disclosure — reflecting the speed and scale of observed exploitation.
Proof-of-concept exploit code became publicly available rapidly after JetBrains released the advisory, and multiple threat actor groups were documented exploiting internet-facing TeamCity instances within hours of disclosure. Attacks followed a consistent pattern: unauthenticated requests to specific administrative API endpoints allowed the creation of new administrator accounts, which were then used for persistent access, credential harvesting, and in some cases, deployment of ransomware or other malware. The KEV catalog flags this CVE as associated with ransomware campaigns. Press and media coverage confirmed mass exploitation was underway, with thousands of exposed TeamCity servers targeted across industries including software development, finance, and technology.
Remediation
- Upgrade immediately: Update JetBrains TeamCity to version 2023.11.4 or later, which contains the official patch for CVE-2024-27198. This is the definitive fix.
- Apply vendor mitigations if patching is delayed: Follow JetBrains' published mitigation guidance if an immediate upgrade is not possible. Consider temporarily restricting network access to the TeamCity server.
- Audit administrator accounts: Review all TeamCity administrator accounts for unauthorized additions created by potential exploitation. Remove any suspicious accounts immediately.
- Rotate credentials and secrets: Any credentials, API tokens, or secrets stored in or accessible via TeamCity should be considered compromised and rotated.
- Inspect build pipelines: Audit recent build configurations, scripts, and artifacts for signs of tampering or injected malicious code.
- Restrict network access: If TeamCity does not need to be publicly internet-accessible, place it behind a VPN or firewall and restrict access to authorized IP ranges only.
- Monitor for indicators of compromise: Review TeamCity access logs, audit logs, and server-side indicators for signs of unauthorized access prior to patching.
- Follow CISA guidance: Consult the CISA KEV catalog entry for CVE-2024-27198 for official remediation requirements applicable to federal agencies and best practices for all organizations.
Technical Details
CVE-2024-27198 exploits a flaw in how JetBrains TeamCity handles request routing and authentication for its REST API and web interface. In versions before 2023.11.4, certain administrative endpoints were accessible via URL paths or parameter combinations that bypassed the standard authentication filter chain. This is the essence of CWE-288: the product's primary authentication mechanism guards the expected paths, but fails to enforce equivalent controls on all accessible routes to the same privileged functionality.
Attack mechanics: Attackers sent crafted HTTP requests to specific API endpoints (such as those used for user creation or plugin installation) using URL path segments or query parameters that caused the server to skip authentication checks. Because no credentials were required, the attack was fully unauthenticated and could be executed remotely by anyone with network access to the TeamCity web interface (typically port 8111 by default).
Post-exploitation: After bypassing authentication, attackers typically created new administrator-level accounts to establish persistent access. From this foothold, they could access source code, steal build secrets and environment variables, modify build configurations to inject malicious steps, and download artifacts. The integration of TeamCity with source code repositories (GitHub, GitLab, Bitbucket, etc.) made credential theft particularly impactful.
Scope: The vulnerability affects JetBrains TeamCity in all deployment modes (on-premises). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms: network-reachable, low complexity, no privileges, no user interaction, with high impact on confidentiality, integrity, and availability. A related but distinct vulnerability, CVE-2024-27199, was disclosed simultaneously and also addressed in the 2023.11.4 patch.
Frequently Asked Questions
What is CVE-2024-27198 and why is it so severe?
CVE-2024-27198 is an authentication bypass vulnerability in JetBrains TeamCity (versions before 2023.11.4) that allows unauthenticated attackers to perform any administrative action remotely. It is rated CRITICAL with a CVSS score of 9.8 because exploitation requires no credentials, no special configuration, and no user interaction — any attacker who can reach the TeamCity web interface can fully compromise the server.
Is CVE-2024-27198 being actively exploited?
Yes. CVE-2024-27198 was actively exploited in mass campaigns almost immediately after public disclosure in March 2024. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog with a March 28, 2024 deadline. The EPSS score of 0.946 (100th percentile) reflects extremely high real-world exploitation activity. Ransomware operators and other threat actors were confirmed to have leveraged this vulnerability.
What should I do if I suspect my TeamCity instance was compromised?
If you believe your TeamCity instance may have been exploited, you should: (1) immediately upgrade to 2023.11.4 or later and restrict network access; (2) audit all administrator accounts for unauthorized additions; (3) rotate all secrets, tokens, and credentials stored in or accessible via TeamCity; (4) review build configurations and recent artifacts for signs of tampering; and (5) consider engaging incident response professionals if supply chain compromise is suspected.
Which versions of JetBrains TeamCity are affected by CVE-2024-27198?
All versions of JetBrains TeamCity prior to 2023.11.4 are vulnerable to CVE-2024-27198. The fix was released in version 2023.11.4. Organizations running any earlier version should treat the instance as potentially compromised if it was network-accessible, and should upgrade immediately.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.