Two vulnerabilities with publicly available exploit code in JetBrains TeamCity on-premises software could result in attackers bypassing authentication and achieving code execution.

CVE-2024-27198, CVE-2024-27199: Two Authentication Bypass Vulnerabilities in JetBrains TeamCity

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

JetBrains TeamCity version prior to 2023.11.4 suffer from an authentication bypass allowing an unauthenticated attacker to gain administrative control of the TeamCity server via a specially crafted URL.

An authentication bypass vulnerability exists in JetBrains TeamCity versions prior to 2023.11.4. An unauthenticated, remote attacker can exploit this, via a specially crafted HTTP GET request, to bypass authentication and perform admin actions remotely.

According to its its self-reported version number, the version of JetBrains TeamCity running on the remote host is a version prior to 2023.11.4. It is, therefore, affected by multiple vulnerabilities:

  - Authentication bypass allowing to perform admin actions was possible. (CVE-2024-27198)

  - Path traversal allowing to perform limited admin actions was possible. (CVE-2024-27199)

Note that Nessus did not actually test for these issues, but instead has relied on the version found in the server's banner.

ID	Name	Product	Family	Severity
114225	JetBrains TeamCity < 2023.11.4 Authentication Bypass	Web App Scanning	Component Vulnerability	critical
191547	JetBrains TeamCity Authentication Bypass (CVE-2024-27198)	Nessus	Web Servers	critical
191533	TeamCity Server < 2023.11.4 Multiple Vulnerabilities	Nessus	Web Servers	critical

Detections

Analytics

CVE-2024-27198

critical

Tenable Plugins

critical

critical

critical