CVE-2024-27198, CVE-2024-27199: Two Authentication Bypass Vulnerabilities in JetBrains TeamCity
Two vulnerabilities with publicly available exploit code in JetBrains TeamCity on-premises software could result in attackers bypassing authentication and achieving code execution.
Update March 7: The blog has been updated to include information in-the-wild exploitation of CVE-2024-27198.
Background
On March 4, JetBrains published a blog post regarding two security issues affecting TeamCity On-Premises, a software solution for build management. The issues were disclosed to JetBrains in February by the researchers who discovered these vulnerabilities. In the March 4 release notes, no mention was made of what security issues were patched, however later in the day, a blog post regarding the release of TeamCity 2023.11.4 was published which included details about the two vulnerabilities.
| CVE | Description | CVSSv3 | Severity |
|---|---|---|---|
| CVE-2024-27198 | Authentication bypass vulnerability | 9.8 | Critical |
| CVE-2024-27199 | Path traversal vulnerability which allows for authentication bypass | 7.3 | High |
Analysis
CVE-2024-27198 is an authentication bypass vulnerability with a critical CVSSv3 rating of 9.8. The vulnerability is within the web component of TeamCity and stems from an alternate path issue. Exploitation of this vulnerability could allow an attacker to bypass authentication in order to take administrative control of an affected TeamCity server. With this level of access, the attacker could execute arbitrary code and abuse this access for a supply chain attack.
CVE-2024-27199 is another authentication bypass vulnerability in the web component of TeamCity, made possible by a path traversal issue. The vulnerability received a CVSSv3 score of 7.3 and while this vulnerability is less severe, it can still be abused by an unauthenticated attacker.
These CVE alerts are primarily a concern for organizations running on-premises installations of TeamCity, and it is crucial that administrators of on-premises servers take steps to update their systems immediately. JetBrains has confirmed TeamCity Cloud customers have already had their servers patched, and have confirmed no evidence of exploitation has occurred for cloud customers.
Historical exploitation of TeamCity vulnerabilities
Unfortunately, this is not the first authentication bypass vulnerability to impact TeamCity servers. CVE-2023-42793, another authentication bypass vulnerability patched in September, saw a variety of exploitation attempts within days of exploit details being released. In October, it was claimed that state sponsored North Korean hackers were responsible for impersonating IT workers and attacking software developers via CVE-2023-42793.
Shortly after, in December, law enforcement from Poland, the United States, and the United Kingdom warned that CVE-2023-42793 was being used by Russian state sponsored groups to target unpatched instances of TeamCity servers. APT 29, also known as Cozy Bear, is a threat actor well known for supply chain and malware attacks across a variety of industries and sectors including energy companies and political organizations. Their abuse of CVE-2023-42793 and the exploitation from a wide range of threat actor groups are a reminder of the severe damage that can be inflicted in well organized attacks. We expect to see continued attacks on TeamCity instances and organizations running vulnerable versions of TeamCity should take the latest warnings seriously and remediate these vulnerabilities as soon as possible.
Exploitation has been observed
In a post on X (formerly Twitter), LeakIX revealed that they have observed over 1400 instances of compromised TeamCity servers with evidence of "clear signs of rogue user creation."
⚠️We added detection for compromised #TeamCity instances:
1711 vulnerable instances were found during our last scan, 1442 show clear signs of rogue user creation.
If you were/are still running a vulnerable system, assume compromise. pic.twitter.com/BIvscjRxZJ— LeakIX (@leak_ix) March 6, 2024
With in-the-wild exploitation already underway, it's imperative to take action to remediate these vulnerabilities as well as begin incident response processes to identify if your server has been compromised.
Proof of concept
At the time this blog was published, public proof-of-concept (PoC) code is available. Additionally, active exploitation attempts of CVE-2024-27198 have been observed.
If running JetBrains TeamCity on-prem - make sure to patch for latest CVE-2024-27198 (remote auth bypass) & CVE-2024-27199 vulns NOW!
We started seeing exploitation activity for CVE-2024-27198 around Mar 4th 22:00 UTC. 16 IPs seen scanning so far.https://t.co/zZ0iU5MD8S— Shadowserver (@Shadowserver) March 5, 2024
Solution
JetBrains has released TeamCity version 2023.11.4 to address both of these authentication bypass vulnerabilities.
JetBrains advises customers to update or patch as soon as possible. In situations where either of these options are not available and devices are internet facing, JetBrains recommends taking impacted devices offline until the patch can be applied.
In instances where upgrading to version 2023.11.4 is not possible, JetBrains offers a standalone security patch, with versions available for TeamCity 2018.2 and newer as well as TeamCity 2018.1 and older.
With public PoC code available and historical exploitation of TeamCity servers, we recommend patching or updating your installation as soon as possible.
Identifying affected systems
A list of Tenable plugins to identify affected systems can be found on the individual CVE pages for CVE-2024-27198 and CVE-2024-27199. This link will display all available plugins for these vulnerabilities, including upcoming plugins in our Plugins Pipeline.
Get more information
- TeamCity Blog: Additional Critical Security Issues Affecting TeamCity On-Premises (CVE-2024-27198 and CVE-2024-27199) – Update to 2023.11.4 Now
- TeamCity followup blog: Insights and Timeline: Our Approach to Addressing the Recently Discovered Vulnerabilities in TeamCity On-Premises
Change Log
Update March 7: The blog has been updated to include information in-the-wild exploitation of CVE-2024-27198.
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
Related Articles
Web App Scanning 101: What Security Pros Need to Know About CI/CD Pipelines
December 19, 2024Git, repositories and pipelines…oh my! We unpack standard practices in the web app development process and provide guidance on how to use Tenable Web Application Scanning to secure your code.
Microsoft Patch Tuesday 2024 Year in Review
December 10, 2024Microsoft addressed over 1000 CVEs as part of Patch Tuesday releases in 2024, including 22 zero-day vulnerabilities.
Microsoft’s December 2024 Patch Tuesday Addresses 70 CVEs (CVE-2024-49138)
December 10, 2024Microsoft addresses 70 CVEs with 16 rated critical, including one zero-day that was exploited in the wild.
Cybersecurity Snapshot: CISA Hands Down Cloud Security Directive, While Threat from North Korean IT Workers Gets the Spotlight
December 20, 2024Check out the new cloud security requirements for federal agencies. Plus, beware of North Korean government operatives posing as remote IT pros. Also, learn how water plants can protect their HMIs against cyberattacks. And get the latest on the U.S. cyber incident response framework; the CIS Benchmarks; and local and state governments’ cyber challenges.
Web App Scanning 101: What Security Pros Need to Know About CI/CD Pipelines
December 19, 2024Git, repositories and pipelines…oh my! We unpack standard practices in the web app development process and provide guidance on how to use Tenable Web Application Scanning to secure your code.
Cybersecurity Snapshot: Telecoms May Face Tougher Regulations After Salt Typhoon Hacks, as Study Finds Cyber Pros More Stressed at Work
December 13, 2024The FCC wants stronger cyber regulations for telecoms after cyber espionage breaches. Meanwhile, find out why cyber pros say work has become more difficult. Plus, check out tips to prevent AI-boosted financial fraud. And get the latest on vulnerability management, EU cyber challenges and CIS predictions for 2025.
- Exposure Management