CRITICALSupply chainexploited in the wildransomware

SC-TEAMCITY-2024

CI/CD · TeamCity · JetBrains TeamCity On-Premises

Summary

CVE-2024-27198 was a critical (CVSS 9.8) authentication bypass in JetBrains TeamCity On-Premises disclosed by Rapid7 on March 4, 2024, that let an unauthenticated remote attacker gain full administrative control of the CI/CD server. The bypass abused the request handling: an attacker requested a non-existent path that returns a 404, then supplied an HTTP query parameter jsp=/app/rest/server pointing at a protected REST endpoint and appended a path parameter ;.jsp to satisfy the .jsp extension check, so the request was treated as a permitted static resource and the auth filter was skipped while the framework rewrote the view to the authenticated endpoint, reaching admin REST APIs to create a new administrator user or generate an admin access token and upload malicious plugins for code execution. A second flaw disclosed alongside it, CVE-2024-27199 (CVSS 7.3), was a path traversal in unauthenticated paths such as /res/ and /.well-known/acme-challenge/ that exposed limited admin functionality. CVE-2024-27198 was added to the CISA KEV catalog on March 7, 2024 and was mass-exploited within days, with more than 1,400 servers compromised and attackers creating rogue admin accounts to deploy BianLian and Jasmin ransomware, the Spark RAT, and the XMRig cryptominer.

How to avoid it in your code

Patch to TeamCity On-Premises 2023.11.4 or later immediately.
Do not expose the TeamCity server to the public internet; restrict access via VPN or an allowlist.
Audit for unexpected admin users, access tokens, and uploaded plugins, and remove any found.
Rotate all secrets, build credentials, and tokens stored in or reachable from TeamCity.
Run the CI service with least-privilege accounts and alert on new admin-account creation.

References

Related vulnerabilities

All Supply chain →