Two vulnerabilities with publicly available exploit code in JetBrains TeamCity on-premises software could result in attackers bypassing authentication and achieving code execution.

CVE-2024-27198, CVE-2024-27199: Two Authentication Bypass Vulnerabilities in JetBrains TeamCity

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

Reports indicate the BianLian ransomware group is exploiting this flaw to gain initial access to conduct ransomware attacks. Patching TeamCity is strongly advised.

With a public proof-of-concept available and active exploitation for CVE-2024-27198, organizations that use TeamCity are strongly encouraged to upgrade as soon as possible.

Both TeamCity vulnerabilities have reportedly been exploited to distribute a modified version of Jasmin, a red team ransomware tool. Patching is strongly advised.

Reports of exploitation have been observed attempting to generate admin accounts. Organizations using TeamCity are encouraged to patch as soon as possible.

With a public proof-of-concept available and ease of exploitation for CVE-2024-27198, organizations that use TeamCity are strongly encouraged to upgrade as soon as possible.

JetBrains TeamCity version prior to 2023.11.4 suffer from an authentication bypass allowing an unauthenticated attacker to gain administrative control of the TeamCity server via a specially crafted URL.

An authentication bypass vulnerability exists in JetBrains TeamCity versions prior to 2023.11.4. An unauthenticated, remote attacker can exploit this, via a specially crafted HTTP GET request, to bypass authentication and perform admin actions remotely.

The version of JetBrains TeamCity installed on the remote host is prior to 2023.11.4. It is, therefore, affected by multiple vulnerabilities:

  - In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the password type could     be disclosed (CVE-2024-28173)

  - In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin     were authorized improperly (CVE-2024-28174)

  - In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was     possible (CVE-2024-27198)

  - In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was     possible (CVE-2024-27199)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
114225	JetBrains TeamCity < 2023.11.4 Authentication Bypass	Web App Scanning	Component Vulnerability	Check Based	critical
191547	JetBrains TeamCity Authentication Bypass (CVE-2024-27198)	Nessus	Web Servers	Remote	critical
191533	JetBrains TeamCity < 2023.11.4 Multiple Vulnerabilities	Nessus	Misc.	Combined	critical

Detections

Analytics

CVE-2024-27198

critical

Tenable Plugins

critical

critical

critical