CVE-2024-27199
JetBrains TeamCity Relative Path Traversal Vulnerability
Description
CVE-2024-27199 is a relative path traversal vulnerability in JetBrains TeamCity, a widely used CI/CD (Continuous Integration / Continuous Delivery) platform, affecting all versions prior to 2023.11.4. The vulnerability allows unauthenticated remote attackers to traverse restricted path boundaries within the TeamCity web application and invoke limited administrative actions without authentication by accessing specific endpoints through crafted relative path sequences. TeamCity was patched in version 2023.11.4, released in March 2024, alongside the more severe CVE-2024-27198 (an authentication bypass with full admin access) — the two vulnerabilities were frequently exploited together as a compound attack chain, with CVE-2024-27198 providing initial complete admin access and CVE-2024-27199 providing additional bypass capability. CI/CD platform compromise is particularly dangerous because it enables supply chain attacks: an attacker with access to build configurations can inject malicious code into compiled artifacts, modify deployment scripts, exfiltrate secrets stored in build environment variables, and backdoor software releases that are then distributed to downstream customers and users. CISA added CVE-2024-27199 to the KEV catalog on 2026-04-20, with a remediation due date of 2026-05-04. The EPSS score is 0.91744, placing it in the 99.7th percentile — the top 0.3% of all CVEs by exploitation probability — consistent with the observed widespread exploitation that followed the March 2024 disclosure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| jetbrains | teamcity | < 2023.11.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
References
- https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive(Press/Media Coverage)
- https://www.jetbrains.com/privacy-security/issues-fixed/(Vendor Advisory)
- https://github.com/Stuub/RCity-CVE-2024-27198/blob/main/RCity.py(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27199(US Government Resource)
Weakness Type
CWE-23: Relative Path Traversal
CWE-23 describes a vulnerability where an application uses external input to construct a file path or resource identifier but fails to properly neutralize sequences such as ../ (dot-dot-slash) that can cause the application to traverse outside the intended directory or path scope. In CVE-2024-27199, the path traversal occurs at the web application routing layer rather than the filesystem layer — attackers use relative path sequences in HTTP request URLs to reach internal TeamCity endpoints that are intended to be restricted to authenticated administrators, bypassing the access control checks that would normally gate those endpoints. The vulnerability allows the attacker to invoke these endpoints without triggering the standard authentication middleware because the traversed path lands outside the code paths that enforce authentication.
Relative path traversal in web application routing contexts is distinct from classic filesystem directory traversal but equally dangerous. When the traversal bypasses authentication rather than accessing arbitrary files, the consequence is effectively an authentication bypass for a scoped subset of functionality. In TeamCity's case, the "limited admin actions" reachable via this traversal include operations that, when combined with CVE-2024-27198 (full authentication bypass), enabled complete server takeover. Even in isolation, the reachable admin actions could allow configuration reads, user creation, or agent modification depending on which specific endpoints were accessible through the traversal. The March 2024 exploitation campaigns demonstrated that threat actors were chaining these two vulnerabilities to achieve full, persistent administrative access to TeamCity servers within hours of the patch release.
Learn more: CWE-23 — Relative Path Traversal
Impact Analysis
The attack vector is Network — CVE-2024-27199 is exploitable from any network location that can reach the TeamCity web interface, which is often exposed to the internet for distributed development teams or hosted on cloud infrastructure with broad network access. Attack Complexity is Low — crafting the traversal path requires no special preconditions, target-specific knowledge, or race conditions beyond knowing the TeamCity server address. Privileges Required is None — the entire premise of the vulnerability is that authentication is bypassed by the path traversal. User Interaction is None.
The scope of impact for CVE-2024-27199 in isolation is constrained to the specific admin actions reachable through the traversal, but in the real-world context of its coordinated disclosure alongside CVE-2024-27198, the compound impact is Complete: full administrative access to the TeamCity server, all build configurations, all stored secrets and environment variables, all VCS root credentials, and all build agents. Confidentiality impact is High due to access to source code, build secrets, API keys, signing certificates, and cloud provider credentials typically stored in TeamCity build configurations. Integrity impact is High: an attacker with admin access can modify build configurations to inject malicious steps, alter artifact output paths, insert backdoors into source code via forced commits, or tamper with deployment pipelines. Availability impact is High: build infrastructure can be disabled, agents disconnected, or build history destroyed.
The supply chain dimension elevates the real-world impact beyond the immediate TeamCity host — software built and signed by a compromised TeamCity instance may distribute malware to customers, partners, and end users, as observed in the SolarWinds and 3CX supply chain incidents. The 99.7th percentile EPSS score and active ransomware use make this one of the most critical remediation priorities for any organization running unpatched TeamCity.
Exploit Maturity
CVE-2024-27199 has one of the highest exploitation maturity profiles of any vulnerability currently in the KEV catalog. CISA added it on 2026-04-20 with a due date of 2026-05-04, but exploitation in the wild had begun within days of the March 4, 2024 patch release — meaning the vulnerability has had over two years of active exploitation history. The EPSS score of 0.91744 places it in the 99.7th percentile, the top 0.3% of all CVEs, reflecting sustained high-volume exploitation attempts that have been consistently captured in threat intelligence feeds since March 2024.
Ransomware use is confirmed. Multiple threat intelligence sources documented ransomware operators exploiting CVE-2024-27198 and CVE-2024-27199 in compound attacks shortly after public disclosure, using compromised TeamCity instances to deploy ransomware payloads through the CI/CD pipeline's native software distribution capabilities. This is a particularly efficient ransomware vector because TeamCity's build agents on managed systems can be used to execute arbitrary commands under the context of the build agent service account.
Nation-state threat actors were also observed exploiting these vulnerabilities. JetBrains, Rapid7, and subsequent threat intelligence reporting documented advanced persistent threat activity targeting TeamCity instances in the weeks following disclosure, consistent with the observed pattern of nation-state interest in CI/CD platforms for supply chain infiltration (as seen with the earlier CVE-2023-42793 TeamCity vulnerability exploited by Lazarus Group and Midnight Blizzard). Any organization that ran unpatched TeamCity versions between March 2024 and their patch date should conduct a compromise assessment regardless of the current KEV listing date.
Remediation
-
CISA KEV Directive Compliance: Federal civilian executive branch agencies must remediate CVE-2024-27199 by 2026-05-04 per BOD 22-01. Given the 99.7th percentile EPSS score and known ransomware campaign exploitation, all organizations should apply the same urgency regardless of regulatory requirements.
-
Upgrade TeamCity to 2023.11.4 or Later: The fix for CVE-2024-27199 (and the co-disclosed CVE-2024-27198) was included in JetBrains TeamCity 2023.11.4, released March 4, 2024. Upgrade immediately to 2023.11.4 or any later release. For TeamCity Cloud instances, JetBrains applied patches automatically. For self-hosted instances, upgrade via the TeamCity Administration > Updates interface or by downloading the installer from jetbrains.com. Verify the installed version at Administration > Global Settings.
-
Interim Mitigations: If immediate upgrade is not possible, restrict access to the TeamCity web interface to only trusted IP ranges using firewall rules or a reverse proxy with IP allowlisting. Disable public internet exposure of the TeamCity server entirely during the remediation window. Consider placing TeamCity in maintenance mode to prevent new build executions while the risk is elevated.
-
Network and Access Controls: Audit all network paths to the TeamCity instance. TeamCity should never be directly internet-facing without VPN or network-level authentication as a prerequisite. Ensure build agents are also isolated from the internet and only communicate with the TeamCity server over internal networks. Review cloud security group rules and load balancer configurations for any public-facing TeamCity listeners.
-
Incident Investigation and Threat Hunting: Given the confirmed KEV listing and widespread exploitation that began in March 2024, any organization running TeamCity versions prior to 2023.11.4 should conduct a thorough compromise assessment. Review TeamCity audit logs for unauthorized administrator account creation, build configuration changes, new VCS root additions, and unexpected plugin installations. Examine build agent logs for unexpected script executions. Hunt for web shell files in the TeamCity installation directory. Rotate all secrets stored in TeamCity: VCS credentials, cloud API keys, signing certificates, and deployment credentials. Check downstream build artifacts for tampering if compromise is suspected.
-
Supply Chain Hardening Against CWE-23: Implement artifact signing and hash verification for all build outputs so that downstream consumers can detect tampered artifacts. Use separate, isolated TeamCity instances for production build pipelines versus development. Apply the principle of least privilege to TeamCity project and build configuration permissions. Store secrets in external vault systems (HashiCorp Vault, AWS Secrets Manager) rather than directly in TeamCity build parameters where possible. Enable TeamCity's audit log and forward it to a SIEM for real-time anomaly detection.
Technical Details
CVE-2024-27199 was disclosed by JetBrains in coordination with Rapid7, who discovered and reported both CVE-2024-27199 and CVE-2024-27198 to JetBrains. The vulnerabilities were patched in TeamCity 2023.11.4 on March 4, 2024, and detailed in JetBrains' security bulletin (TW-85531 / TW-85530). Rapid7 published technical analysis shortly after the patch, and proof-of-concept exploit code became publicly available within days of the advisory.
The path traversal mechanism in CVE-2024-27199 exploits the way TeamCity's routing layer handles certain URL patterns. By inserting relative path traversal sequences (../, URL-encoded variants, or double-encoded sequences) into HTTP request paths targeting specific endpoints, attackers can reach internal TeamCity servlet endpoints that process requests without requiring the full authentication context normally enforced by the application's security filter chain. The accessible endpoints via this traversal include some that allow limited administrative operations — the exact set depends on the TeamCity version and configuration, but in the March 2024 exploitation campaigns, attackers were observed using CVE-2024-27198 for primary access and CVE-2024-27199 as a secondary bypass mechanism.
CVE-2024-27198 (Critical, CVSS 9.8) is the sibling vulnerability — an alternative authentication bypass path that granted unrestricted admin access. The two were typically chained: CVE-2024-27198 to create a new admin account, then use that account for persistent access, with CVE-2024-27199 providing a secondary bypassed access route. Nation-state actors (publicly attributed by JetBrains advisory context and subsequent threat intelligence to include actors associated with the Midnight Blizzard / Cozy Bear cluster, following their prior interest in TeamCity from CVE-2023-42793) and cybercriminal ransomware groups both exploited these vulnerabilities within the same exploitation window.
The CVSS 3.1 base score for CVE-2024-27199 reflects High severity (AV:N/AC:L/PR:N/UI:N/S:U) with partial scope of admin action access rather than the full Critical of CVE-2024-27198. In isolation, CVE-2024-27199 is High; in the compound attack chain with CVE-2024-27198, the combined real-world impact is Critical.
Frequently Asked Questions
Is CVE-2024-27199 being actively exploited?
Yes — and has been since March 2024, immediately following its public disclosure. CISA added it to the KEV catalog and the 99.7th percentile EPSS score confirms sustained widespread exploitation. Ransomware operators and nation-state threat actors have both been documented exploiting this vulnerability, often chained with the sibling vulnerability CVE-2024-27198. Any TeamCity instance not yet upgraded to version 2023.11.4 or later should be considered potentially compromised.
What products are affected?
JetBrains TeamCity, all versions prior to 2023.11.4 (self-hosted). TeamCity Cloud was patched automatically by JetBrains. The vulnerability affects TeamCity's web application routing layer regardless of underlying operating system or deployment environment (Linux, Windows, Docker). CVE-2024-27199 was typically exploited alongside CVE-2024-27198, which is a separate but co-disclosed authentication bypass in the same TeamCity versions.
How do I fix it?
Upgrade JetBrains TeamCity to version 2023.11.4 or later. The patch was released on March 4, 2024. Navigate to Administration > Updates in the TeamCity web interface or download the updated installer from jetbrains.com. After patching, conduct a compromise assessment if the instance was previously exposed: review audit logs, rotate all stored credentials, and verify build artifact integrity if administrative access was potentially compromised.
How severe is it?
CVE-2024-27199 is rated High in isolation, but Critical in the real-world compound attack context with CVE-2024-27198. Together, they allowed complete unauthenticated takeover of TeamCity CI/CD servers. Compromise of a CI/CD server enables supply chain attacks — injecting malicious code into build artifacts that are then distributed to customers and end users, as well as ransomware deployment via build agents. The 99.7th percentile EPSS score and confirmed ransomware use make this one of the most critical vulnerability remediations in the current landscape.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.