cyber.hendryadrian.com
Vulnerability & Exploit · wiz.io

TeamCity Authentication Bypass Flaws Allow Unauthenticated Administrative Access

· Original article ↗

Summary

Two TeamCity on-premises authentication-bypass flaws affect versions before 2023.11.4; exploitation attempts were observed, and CVE-2024-27198 was added to CISA’s KEV catalog. JetBrains recommends upgrading or applying a security patch plugin.

Key points

  • CVE-2024-27198 (CVSS 9.8) and CVE-2024-27199 (CVSS 7.3) can let unauthenticated attackers bypass authentication on vulnerable TeamCity servers.
  • CVE-2024-27198 can enable administrative control, including creating administrator accounts or tokens; CVE-2024-27199 can expose information and permit system-setting changes.
  • Exploitation attempts were observed by GreyNoise and Shadowserver; CISA added CVE-2024-27198 to its Known Exploited Vulnerabilities catalog on March 7, 2024.
  • All TeamCity On-Premises versions before 2023.11.4 are affected; TeamCity Cloud instances were patched automatically.
  • JetBrains recommends upgrading to TeamCity 2023.11.4 or later. A security patch plugin is available for users who cannot upgrade yet.
  • Wiz reported that, as of March 6, 2024, 8.5% of cloud environments it analyzed had instances vulnerable to the flaws.

Article Details

Vulnerability Types
  • Authentication bypass
  • Path traversal
Severity
CVE-2024-27198 is critical (CVSS 9.8); CVE-2024-27199 is high severity (CVSS 7.3).
Affected Versions
  • TeamCity On-Premises versions before 2023.11.4
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Install JetBrains' security patch plugin; the article says it supports TeamCity versions through 2023.11.3, with separate plugin options for TeamCity 2018.2 and newer or TeamCity 2018.1 and older.

CVE

CVE-2024-27198JetBrains released a patch for two critical and high severity authentication bypass vulnerabilities — CVE-2024-27198 (CVSS score: 9.8) and CVE-2024-27199 (CVSS score: 7.3). Each of these vulnerabilities may enable anCVE-2024-27199and high severity authentication bypass vulnerabilities — CVE-2024-27198 (CVSS score: 9.8) and CVE-2024-27199 (CVSS score: 7.3). Each of these vulnerabilities may enable an unauthenticated attacker who has

Vendors

JetBrainsOn March 4, 2024, JetBrains released a patch for two critical and high severity authentication bypass vulnerabilities — CVE-2024-27198 (CVSS score: 9.8) and CVE-2024-27199 (CVSS score: 7.3). Each of these

Products

JetBrains TeamCity7.3). Each of these vulnerabilities may enable an unauthenticated attacker who has HTTP(s) access to a TeamCity server to bypass authentication checks and gain administrative control of the server. Exploitation

Related Articles