CVE-2024-27199: JetBrains TeamCity Relative Path Traversal Vulnerability

JetBrains TeamCity contains a relative path traversal vulnerability tracked as CVE-2024-27199. The flaw permits an attacker to carry out limited administrative actions on affected installations. The issue is notable because the vulnerability has seen use in ransomware campaigns.

How it works

The weakness is classified under CWE-23, relative path traversal. In this class of flaw an attacker can supply crafted path elements that cause the application to access files or resources outside the intended directory scope. For TeamCity the result is the ability to execute a restricted set of administrative operations. Exact request patterns and preconditions must be confirmed against the vendor advisory.

Am I affected? How to find it in your systems

TeamCity is typically deployed as an on-premises continuous-integration server. Inventory all instances by querying configuration-management databases, scanning for the TeamCity service ports, and reviewing orchestration manifests. Check the installed build against the versions and configurations listed in the vendor advisory. Review authentication and access-control logs for anomalous administrative requests that reference unexpected path traversals.

How to remediate

Apply the vendor-supplied update referenced in the official advisory. After patching, review TeamCity administrative accounts and reduce the number of users granted elevated rights. Enforce least-privilege access to build projects and agents. Confirm that any external integrations do not bypass the updated path-handling logic.

If you can't patch immediately

Follow the mitigations published by the vendor. For cloud-hosted instances apply the controls required by CISA BOD 22-01. Where mitigations cannot be implemented, isolate the TeamCity server on a dedicated network segment and restrict inbound access to only trusted build agents and administrators. Monitor authentication and file-access logs for indicators of traversal attempts until the update can be applied or the service is decommissioned.

If your data may have been exposed

Because the vulnerability has been used in ransomware operations, any successful exploitation may have resulted in data access or further compromise. Review authentication and build logs for suspicious administrative activity. Organizations can run a free exposure scan of their email domains against known breach data to identify accounts that have already appeared in public incidents.