CVE-2024-27198: JetBrains TeamCity Authentication Bypass Vulnerability

CVE-2024-27198 is an authentication bypass vulnerability in JetBrains TeamCity that lets an unauthenticated attacker perform administrative actions. Because TeamCity often sits at the center of build and deployment pipelines, successful abuse can give an attacker control over source code, credentials, and release processes. CISA notes known ransomware use of this issue, so organizations running TeamCity should treat it as high priority and confirm all details against the vendor advisory.

This guidance is for IT and security teams. It stays within publicly stated facts: the product, the CWE class, the ability to perform admin actions, and the ransomware association. Exact versions, scores, and exploit steps are not listed here; always verify them in the JetBrains advisory.

How it works

The weakness is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). In plain terms, the product fails to enforce authentication correctly on certain paths or channels, so an attacker can reach functionality that should require a valid admin session.

Once past the authentication check, the attacker can perform administrative actions. Those actions typically include creating or modifying users, changing project settings, installing plugins, or accessing build configurations and secrets. No further exploit mechanics are described in the provided facts; defenders should treat any unauthenticated request that results in admin-level state changes as a potential indicator and confirm the precise attack surface against the vendor advisory.

Am I affected? How to find it in your systems

JetBrains TeamCity is a continuous-integration and continuous-delivery server commonly deployed on-premises or in private clouds to orchestrate builds, tests, and deployments. It is often reachable on internal networks or, less commonly, exposed to the internet.

• Inventory every host that runs the TeamCity server process or its associated web interface. Check configuration-management databases, container registries, and cloud asset inventories for “TeamCity” or the JetBrains installation path.
• Identify the installed version and compare it with the fixed versions listed in the JetBrains advisory. Do not rely on version numbers stated elsewhere; confirm them directly with the vendor.
• Note whether the instance is internet-facing, protected by a reverse proxy, or restricted by network ACLs. Instances that accept unauthenticated HTTP/HTTPS traffic are at highest risk.
• Review access logs and application logs for unexpected administrative operations (user creation, permission changes, plugin installation, or configuration exports) that lack a corresponding authenticated session. Look for anomalous requests to authentication-related or admin endpoints that return success without prior login.
• If you use centralized SIEM or EDR, search for process or network activity originating from the TeamCity host that is inconsistent with normal build-agent behavior.

How to remediate

Patch first. Apply the vendor-supplied update for TeamCity exactly as described in the JetBrains advisory. CISA’s required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

• After installing the update, restart the TeamCity service and verify the new version is reported by the administrative interface.
• Rotate any credentials, API tokens, or SSH keys that were stored in TeamCity and that an attacker could have accessed while the vulnerability was present.
• Review and re-baseline administrative accounts; remove any unexpected users or elevated privileges created during the exposure window.
• Harden the installation: restrict the management interface to trusted networks, enforce strong authentication (including multi-factor where supported), and keep the underlying operating system and Java runtime current.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls.

• Segment the TeamCity server so that only authorized build agents and administrators can reach it; block all other inbound traffic at the network firewall or security group.
• Place a web application firewall or reverse-proxy rule in front of the service to drop or challenge unauthenticated requests to administrative paths. Treat this as virtual patching only; it is not a substitute for the official fix.
• Temporarily disable any optional features or plugins that expand the attack surface, if the vendor guidance permits.
• Increase monitoring: alert on any administrative action, new user creation, or configuration change. Capture full request logs for later forensic review.
• If the risk remains unacceptable and no reliable mitigation exists, take the instance offline until it can be patched, consistent with CISA’s guidance to discontinue use when mitigations are unavailable.

If your data may have been exposed

Actively exploited authentication-bypass flaws, especially those linked to ransomware, frequently lead to credential theft, source-code exfiltration, or full environment compromise. Assume that any secrets stored in TeamCity (tokens, certificates, cloud credentials) may have been accessed. Rotate them, review build and deployment logs for unauthorized changes, and examine downstream systems for lateral movement. As a quick personal check, you can run a free exposure scan of your email address against known breach data sets to see whether related accounts appear in public dumps.