TeamCity Auth Bypass (CVE-2024-27198)

title: TeamCity Authentication Bypass URI Pattern
id: 89a3b09d-4252-59f1-8eeb-d6e115f66ea5
status: experimental
description: Detects requests whose query string carries a jsp= parameter plus a ';' path parameter ending in .jsp, the URI shape Rapid7 documents for CVE-2024-27198 against JetBrains TeamCity.
references:
    - https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/
author: vuln2shell
date: 2026-10-23
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2024-27198
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains|all:
            - 'jsp='
            - ';'
            - '.jsp'
    condition: selection
falsepositives:
    - Unlikely on TeamCity servers
level: high

| tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
  WHERE (
        (Web.url="*?jsp=*"
        AND
        Web.url="*;.jsp*") Web.status=200 Web.http_method=POST
    )
    OR (Web.url IN ("*jsp=/app/rest/users;.jsp","*?jsp=/app/rest/users;.jsp","*?jsp=.*/app/rest/users/id:*/tokens;*") Web.status=200 Web.http_method=POST )
  BY Web.src, Web.dest, Web.http_user_agent,
     Web.url, Web.status, Web.http_method,
     sourcetype, source
| `drop_dm_object_name("Web")`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `jetbrains_teamcity_authentication_bypass_cve_2024_27198_filter`

| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime

from datamodel=Endpoint.Filesystem where

Filesystem.file_path="*:\\ProgramData\\JetBrains\\TeamCity\\plugins\\*"
Filesystem.file_name="*.zip"
Filesystem.action="created"

by Filesystem.dest Filesystem.action Filesystem.file_name Filesystem.user
   Filesystem.vendor_product Filesystem.file_create_time Filesystem.process_path
   Filesystem.process_guid Filesystem.process_id Filesystem.file_path

| `drop_dm_object_name(Filesystem)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_teamcity_plugin_installed_filter`

DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName =~ "java.exe" and InitiatingProcessFolderPath has "TeamCity"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe", "whoami.exe", "net.exe")
| project Timestamp, DeviceName, InitiatingProcessFolderPath, FileName, ProcessCommandLine, AccountName

/;\S*\.jsp\?\S*jsp=/
| groupBy([@host], function=count())

process where host.os.type == "windows" and event.type == "start" and
  process.parent.executable :
                 ("?:\\TeamCity\\jre\\bin\\java.exe",
                  "?:\\Program Files\\TeamCity\\jre\\bin\\java.exe",
                  "?:\\Program Files (x86)\\TeamCity\\jre\\bin\\java.exe",
                  "?:\\TeamCity\\BuildAgent\\jre\\bin\\java.exe") and
  process.name : ("cmd.exe", "powershell.exe", "msiexec.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe", "curl.exe", "ssh.exe",
                   "rundll32.exe", "regsvr32.exe", "mshta.exe", "certreq.exe", "net.exe", "nltest.exe", "whoami.exe", "hostname.exe",
                   "tasklist.exe", "arp.exe", "nbtstat.exe", "netstat.exe", "reg.exe", "tasklist.exe", "Microsoft.Workflow.Compiler.exe",
                   "arp.exe", "atbroker.exe", "bginfo.exe", "bitsadmin.exe", "cdb.exe", "cmstp.exe", "control.exe", "cscript.exe", "csi.exe",
                   "dnx.exe", "dsget.exe", "dsquery.exe", "forfiles.exe", "fsi.exe", "ftp.exe", "gpresult.exe", "ieexec.exe", "iexpress.exe",
                   "installutil.exe", "ipconfig.exe","msxsl.exe", "netsh.exe", "odbcconf.exe", "ping.exe", "pwsh.exe", "qprocess.exe",
                   "quser.exe", "qwinsta.exe", "rcsi.exe", "regasm.exe", "regsvcs.exe", "regsvr32.exe", "sc.exe", "schtasks.exe",
                   "systeminfo.exe", "tracert.exe", "wmic.exe", "wscript.exe","xwizard.exe", "explorer.exe", "msdt.exe") and
 not (process.name : "powershell.exe" and process.args : "-ExecutionPolicy" and process.args : "?:\\TeamCity\\buildAgent\\work\\*.ps1") and
 not (process.name : "cmd.exe" and process.args : "dir" and process.args : "/-c")

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS JetBrains TeamCity Authentication Bypass Attempt (CVE-2024-27198) - Admin User Creation Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"jsp|3d|/app/rest/users"; fast_pattern; content:".jsp"; within:30; http.request_body; content:"|7b|"; startswith; content:"|22|username|22 3a 20 22|"; content:"|22|password|22 3a 20 22|"; content:"|5b 7b 22|roleId|22 3a 20 22|SYSTEM_ADMIN"; reference:cve,2024-27198; reference:url,www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/; classtype:attempted-admin; sid:2051506; rev:5; metadata:affected_product JetBrains_TeamCity, created_at 2024_03_06, cve CVE_2024_27198, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag JetBrains_TeamCity, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_08_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS JetBrains TeamCity Authentication Bypass Attempt (CVE-2024-27199) - Vulnerability Check"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/^\x2f(res|update|\x2ewell-known\x2facme-challenge)\x2f/"; content:"|2e 2e|"; content:"/admin/diagnostic.jsp"; fast_pattern; endswith; reference:cve,2024-27199; reference:url,www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/; classtype:attempted-recon; sid:2051508; rev:2; metadata:affected_product JetBrains_TeamCity, created_at 2024_03_06, cve CVE_2024_27199, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag JetBrains_TeamCity, tag CVE_2024_27199, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)