{"slug":"teamcity-auth-bypass","title":"TeamCity Auth Bypass (CVE-2024-27198)","shortName":"TeamCity Auth Bypass","summary":"Unauthenticated authentication bypass in JetBrains TeamCity On-Premises enabling administrator access and plugin-based RCE. CVSS 9.8. Mass exploitation reported within days of disclosure. Listed in CISA KEV on 7 Mar 2024.","isExample":false,"draft":false,"family":"teamcity-auth-bypass","kind":"single-product","aliases":["CVE-2024-27198","CVE-2024-27199"],"publishedAt":"2024-03-04","updatedAt":"2026-10-24","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2024-27198","cvss":{"cve":"CVE-2024-27198","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"nvd","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-27198","sourceDate":"2026-06-17","checkedDate":"2026-10-24"},"epss":{"cve":"CVE-2024-27198","score":0.99938,"percentile":0.99972,"date":"2026-10-23","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-27198","checkedDate":"2026-10-24"},"kev":{"cve":"CVE-2024-27198","listed":true,"dateAdded":"2024-03-07","dueDate":"2024-03-28","catalogVersion":"2026.10.23","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-24"},"addedDate":"2026-10-24"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated authentication bypass in JetBrains TeamCity On-Premises (CVE-2024-27198) leading to administrator access and plugin remote code execution. Mass exploitation followed disclosure. Listed in CISA KEV.","action":"Confirm TeamCity is on 2023.11.4 or later, and treat internet-facing servers that were vulnerable as compromised until users, tokens, and plugins are audited."},"seenInTheWild":[{"metric":"exposed","value":5699,"observer":"Censys","date":"2024-03-05","method":"\"hosts affected globally\" at time of dissemination","sourceUrl":"https://censys.com/advisory/cve-2024-27198/"},{"metric":"possibly-vulnerable","value":1182,"observer":"Shadowserver","date":"2024-03-06","method":"Instances \"still possibly vulnerable\"; patch plugin may mitigate some","sourceUrl":"https://infosec.exchange/@shadowserver/112053658145215926"},{"metric":"exposed","value":4687,"observer":"Shodan","date":"2026-10-23","method":"Product query http.component:\"TeamCity\"","sourceUrl":"https://www.shodan.io/search?query=http.component%3A%22TeamCity%22","note":"Exposed hosts. Data: Shodan."},{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2024-03-07","method":"CISA Known Exploited Vulnerabilities catalog dateAdded","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}],"seenInTheWildLinks":[{"title":"Shadowserver dashboard","url":"https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=http_vulnerable&source=http_vulnerable6&tag=cve-2024-27198%2B&style=stacked","observer":"Shadowserver","metric":"possibly-vulnerable"},{"title":"JetBrains TeamCity CVE-2024-27198 Auth Bypass Attempt","url":"https://viz.greynoise.io/tags/jetbrains-teamcity-cve-2024-27198-auth-bypass-attempt","observer":"GreyNoise","metric":"scanning"}],"whatChanged":{"date":"2026-10-24","items":[{"text":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected"},{"text":"Act-now priority block with sourced CVSS, EPSS, and CISA KEV dates.","section":"priority","addedDate":"2026-10-24"},{"text":"Detection rule coverage table and JSON, IOC CSV, and STIX feeds.","section":"detection","addedDate":"2026-10-24"}]},"whatTheBugIs":"CVE-2024-27198 is an authentication bypass in JetBrains TeamCity On-Premises that allows an unauthenticated attacker with HTTP(S) access to perform administrator actions. NVD scores it CVSS 3.1 9.8. A companion path-traversal issue, CVE-2024-27199, was disclosed at the same time.\n\nRapid7's Stephen Fewer discovered both bugs in February 2024. JetBrains fixed them in TeamCity 2023.11.4 (announced around 3-4 Mar 2024) and stated that TeamCity Cloud had already been patched. By 7 Mar 2024, Dark Reading reported LeakIX detecting thousands of internet-facing TeamCity servers with signs of rogue accounts created via CVE-2024-27198. A Metasploit module and public PoCs followed.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"http","label":"Reach TeamCity HTTP(S)","detail":"Unauthenticated access to a TeamCity On-Premises HTTP(S) listener."},{"id":"bypass","label":"Auth bypass","detail":"A crafted request bypasses authentication checks (CVE-2024-27198)."},{"id":"admin","label":"Admin token or user","detail":"Attacker creates an administrator token or user through the REST API."},{"id":"plugin","label":"Malicious plugin RCE","detail":"A plugin upload yields code execution on the TeamCity server OS. Conceptual impact class only."}]},"exploitation":{"kev":{"listed":true,"date":"2024-03-07","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV entry for CVE-2024-27198, JetBrains TeamCity Authentication Bypass Vulnerability. dateAdded 2024-03-07. knownRansomwareCampaignUse Known. CVE-2024-27199 is also KEV-listed (dateAdded 2026-04-20)."},"firstSeen":{"date":"2024-03-07","source":"Dark Reading / LeakIX","note":"Dark Reading reports LeakIX detecting internet-facing TeamCity servers with signs of rogue accounts created via CVE-2024-27198 by 7 Mar 2024. Earlier opportunistic exploitation may exist; this is the dated public mass-exploitation report used here."},"vendorStatements":[{"vendor":"JetBrains","date":"2024-03-04","statement":"The vulnerabilities may enable an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and gain administrative control of that TeamCity server. Fixed in version 2023.11.4. TeamCity Cloud servers have already been patched.","url":"https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/","retracted":false},{"vendor":"Rapid7","date":"2024-03-04","statement":"Both of these vulnerabilities affect all versions of TeamCity prior to 2023.11.4. Rapid7 recommends that TeamCity customers update their servers immediately.","url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","retracted":false}]},"timeline":[{"date":"2024-02-15","event":"Rapid7 first contacts JetBrains about the issues.","source":{"title":"JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities","url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","publisher":"Rapid7"},"kind":"disclosure","key":true},{"date":"2024-02-20","event":"Rapid7 provides technical analysis; JetBrains reproduces the same day.","source":{"title":"JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities","url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","publisher":"Rapid7"},"kind":"disclosure"},{"date":"2024-03-03","event":"JetBrains releases TeamCity 2023.11.4 (Rapid7 saw the release blog on 4 Mar depending on timezone).","source":{"title":"Additional Critical Security Issues Affecting TeamCity On-Premises","url":"https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/","publisher":"JetBrains"},"kind":"patch","key":true},{"date":"2024-03-04","event":"Rapid7 publishes technical details. NVD publishes CVE-2024-27198.","source":{"title":"JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities","url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","publisher":"Rapid7"},"kind":"advisory","key":true},{"date":"2024-03-06","event":"Public PoC repository W01fh4cker/CVE-2024-27198-RCE appears.","source":{"title":"W01fh4cker/CVE-2024-27198-RCE","url":"https://github.com/W01fh4cker/CVE-2024-27198-RCE","publisher":"W01fh4cker"},"kind":"poc","key":true},{"date":"2024-03-07","event":"CISA adds CVE-2024-27198 to KEV. Dark Reading reports LeakIX mass-exploitation telemetry.","source":{"title":"CISA KEV catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"kev","key":true}],"defenderActions":[{"title":"Upgrade TeamCity On-Premises to 2023.11.4 or later","detail":"JetBrains fixed CVE-2024-27198 and CVE-2024-27199 in 2023.11.4. TeamCity Cloud was already patched. If you cannot upgrade immediately, use JetBrains's security patch plugin described in the advisory.","priority":"now","links":[{"label":"JetBrains advisory","href":"https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/"}]},{"title":"Assume compromise if the server was internet-facing while vulnerable","detail":"LeakIX reported rogue administrator accounts on a large share of exposed vulnerable servers. Rotate tokens, review users, and audit plugins.","priority":"now","links":[{"label":"Dark Reading report","href":"https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive"}]},{"title":"Review TeamCity audit and log artifacts","detail":"Rapid7 documents IOCs in teamcity-javaLogging, teamcity-server.log, teamcity-activities.log, disabled-plugins.xml, and plugin unpack directories after malicious plugin upload.","priority":"soon","links":[{"label":"Rapid7 technical analysis","href":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/"}]},{"title":"Restrict TeamCity HTTP(S) to trusted networks","detail":"Keep CI management interfaces off the public internet. Require VPN or identity-aware proxy access.","priority":"soon"}],"detection":[{"title":";.jsp path rewriting in TeamCity Java logs","detail":"Rapid7 shows successful bypass requests leaving rewritten URIs containing ;.jsp and jsp= in teamcity-javaLogging. Suggested regex patterns include ;\\S*\\.jsp\\?\\S*jsp= .","logSource":"TeamCity Java / server logs","kind":"generic","group":"web-proxy"},{"title":"Admin token or user creation followed by plugin upload","detail":"Look for access-token creation and plugin_uploaded / plugin_deleted audit events in quick succession by the same user id, as Rapid7 documents for the Metasploit-style attack path.","logSource":"TeamCity audit / activities logs","kind":"generic"},{"title":"Unexpected plugin directories under TeamCity work/webapps","detail":"Artifacts may remain under Catalina work directories, webapps/ROOT/plugins, or plugins.unpacked caches after a malicious plugin is deleted.","logSource":"EDR / process telemetry","kind":"generic","group":"edr"},{"title":"NetScaler WAF signature: 998521","detail":"NetScaler WAF signature update version 126: rule 998521 (WEB-MISC JetBrains TeamCity authentication bypass) for CVE-2024-27198.","logSource":"NetScaler WAF (AppFw) logs","kind":"vendor-signature","url":"https://docs.netscaler.com/en-us/citrix-adc/13-1/signature-alerts/signature-update-version-126.html","date":"2026-10-23","dateKind":"checked"},{"title":"Cloudflare WAF Managed Rules: 100629","detail":"JetBrains TeamCity authentication bypass rule 100629 (...2bed8cdd), released 2024-03-18.","logSource":"Cloudflare Security Events / Firewall events","kind":"vendor-signature","url":"https://developers.cloudflare.com/waf/change-log/historical-2024/","date":"2024-03-18"},{"title":"F5 attack signature: 200013085","detail":"JetBrains TeamCity Authentication Bypass (2) (200013085), references CVE-2024-27198, last update 2024-04-04.","logSource":"F5 Advanced WAF / Distributed Cloud WAF event logs","kind":"vendor-signature","url":"https://docs.cloud.f5.com/docs-v2/platform/reference/attack-signatures","date":"2024-04-04"},{"title":"Check Point IPS: CPAI-2024-0104","detail":"Protection 'JetBrains TeamCity Authentication Bypass (CVE-2024-27198)', published 2024-03-06.","logSource":"Check Point IPS logs (SmartConsole / Logs & Monitor)","kind":"vendor-signature","url":"https://advisories.checkpoint.com/defense/advisories/public/2024/cpai-2024-0104.html/","date":"2024-03-06"},{"title":"Cisco Talos Snort: 1:63319-63323","detail":"JetBrains TeamCity directory traversal rules, released 2024-04-23, disabled by default. Rule doc 1:63319 references CVE-2024-27199.","logSource":"Snort / Cisco Secure Firewall IPS event logs","kind":"vendor-signature","url":"https://www.snort.org/advisories/talos-rules-2024-04-23","date":"2024-04-23"},{"title":"Fortinet FortiGuard IPS: 54906 / 54915","detail":"IPS signatures JetBrains.TeamCity.BaseController.Authentication.Bypass (54906, CVE-2024-27198) and JetBrains.TeamCity.CVE-2024-27199.Path.Traversal (54915), both 2024-03-12.","logSource":"FortiGate IPS logs","kind":"vendor-signature","url":"https://www.fortiguard.com/search?q=CVE-2024-27198&engine=1","date":"2024-03-12"},{"title":"Juniper IDP: HTTP:CTS:JB-TEAM-CITY-AUTH-BYPS","detail":"IDP signature for CVE-2024-27198, release date 2024-03-07.","logSource":"Juniper SRX IDP logs","kind":"vendor-signature","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:CTS:JB-TEAM-CITY-AUTH-BYPS.html","date":"2024-03-07"},{"title":"Trend Micro TippingPoint 43957 / 43958, Deep Security 1011995 / 1011996","detail":"TippingPoint 43957 (TeamCity directory traversal) and 43958 (authentication bypass). Deep Security rules 1011995 and 1011996. Listed in Trend Micro research on TeamCity exploitation.","logSource":"Trend Micro Deep Security / TippingPoint SMS event logs","kind":"vendor-signature","url":"https://www.trendmicro.com/en/research/24/c/teamcity-vulnerability-exploits-lead-to-jasmin-ransomware.html","date":"2026-10-23"},{"title":"Netskope IPS: ET 2051505 / 2051506 / 2051507","detail":"Netskope Threat Labs IPS library lists ET WEB_SPECIFIC_APPS JetBrains TeamCity Authentication Bypass Attempt (CVE-2024-27198) SIDs 2051505-2051507. Library pages are undated.","logSource":"Netskope Cloud Firewall / IPS alert logs","kind":"vendor-signature","url":"https://threatlabs.netskope.com/library/ips/et-web-specific-apps-jetbrains-teamcity-authentication-bypass-attempt-cve-2024-27198-vulnerability-check/","date":"2026-10-23","dateKind":"checked"}],"detectionRules":[{"id":"splunk-teamcity-auth-bypass-27198","title":"JetBrains TeamCity Authentication Bypass CVE-2024-27198","language":"spl","query":"| tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web\n  WHERE (\n        (Web.url=\"*?jsp=*\"\n        AND\n        Web.url=\"*;.jsp*\") Web.status=200 Web.http_method=POST\n    )\n    OR (Web.url IN (\"*jsp=/app/rest/users;.jsp\",\"*?jsp=/app/rest/users;.jsp\",\"*?jsp=.*/app/rest/users/id:*/tokens;*\") Web.status=200 Web.http_method=POST )\n  BY Web.src, Web.dest, Web.http_user_agent,\n     Web.url, Web.status, Web.http_method,\n     sourcetype, source\n| `drop_dm_object_name(\"Web\")`\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `jetbrains_teamcity_authentication_bypass_cve_2024_27198_filter`","logSource":"Web data model (Suricata, proxy or access logs)","author":"Michael Haag, Splunk","authorUrl":"https://research.splunk.com/","sourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/jetbrains_teamcity_authentication_bypass_cve_2024_27198.yml","sourceDate":"2026-05-13","license":"Apache-2.0","origin":"vendor","notes":"Uses Splunk ES macros and data models from splunk/security_content; the trailing _filter macro is a tuning hook.","tested":"tested","testedNote":"Splunk security_content YAML includes a True Positive Test and status production.","testedSourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/jetbrains_teamcity_authentication_bypass_cve_2024_27198.yml"},{"id":"splunk-teamcity-plugin-installed","title":"Windows TeamCity Plugin Installed","language":"spl","query":"| tstats `security_content_summariesonly`\n  count min(_time) as firstTime\n        max(_time) as lastTime\n\nfrom datamodel=Endpoint.Filesystem where\n\nFilesystem.file_path=\"*:\\\\ProgramData\\\\JetBrains\\\\TeamCity\\\\plugins\\\\*\"\nFilesystem.file_name=\"*.zip\"\nFilesystem.action=\"created\"\n\nby Filesystem.dest Filesystem.action Filesystem.file_name Filesystem.user\n   Filesystem.vendor_product Filesystem.file_create_time Filesystem.process_path\n   Filesystem.process_guid Filesystem.process_id Filesystem.file_path\n\n| `drop_dm_object_name(Filesystem)`\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `windows_teamcity_plugin_installed_filter`","logSource":"Sysmon EventID 11 (Endpoint.Filesystem data model)","author":"Raven Tait, Splunk","authorUrl":"https://research.splunk.com/","sourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/endpoint/windows_teamcity_plugin_installed.yml","sourceDate":"2026-05-13","license":"Apache-2.0","origin":"vendor","notes":"Uses Splunk ES macros and data models from splunk/security_content; the trailing _filter macro is a tuning hook.","tested":"tested","testedNote":"Splunk security_content YAML includes a True Positive Test and status production.","testedSourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/endpoint/windows_teamcity_plugin_installed.yml"},{"id":"elastic-teamcity-suspicious-child","title":"Suspicious JetBrains TeamCity Child Process","language":"eql","query":"process where host.os.type == \"windows\" and event.type == \"start\" and\n  process.parent.executable :\n                 (\"?:\\\\TeamCity\\\\jre\\\\bin\\\\java.exe\",\n                  \"?:\\\\Program Files\\\\TeamCity\\\\jre\\\\bin\\\\java.exe\",\n                  \"?:\\\\Program Files (x86)\\\\TeamCity\\\\jre\\\\bin\\\\java.exe\",\n                  \"?:\\\\TeamCity\\\\BuildAgent\\\\jre\\\\bin\\\\java.exe\") and\n  process.name : (\"cmd.exe\", \"powershell.exe\", \"msiexec.exe\", \"certutil.exe\", \"bitsadmin.exe\", \"wmic.exe\", \"curl.exe\", \"ssh.exe\",\n                   \"rundll32.exe\", \"regsvr32.exe\", \"mshta.exe\", \"certreq.exe\", \"net.exe\", \"nltest.exe\", \"whoami.exe\", \"hostname.exe\",\n                   \"tasklist.exe\", \"arp.exe\", \"nbtstat.exe\", \"netstat.exe\", \"reg.exe\", \"tasklist.exe\", \"Microsoft.Workflow.Compiler.exe\",\n                   \"arp.exe\", \"atbroker.exe\", \"bginfo.exe\", \"bitsadmin.exe\", \"cdb.exe\", \"cmstp.exe\", \"control.exe\", \"cscript.exe\", \"csi.exe\",\n                   \"dnx.exe\", \"dsget.exe\", \"dsquery.exe\", \"forfiles.exe\", \"fsi.exe\", \"ftp.exe\", \"gpresult.exe\", \"ieexec.exe\", \"iexpress.exe\",\n                   \"installutil.exe\", \"ipconfig.exe\",\"msxsl.exe\", \"netsh.exe\", \"odbcconf.exe\", \"ping.exe\", \"pwsh.exe\", \"qprocess.exe\",\n                   \"quser.exe\", \"qwinsta.exe\", \"rcsi.exe\", \"regasm.exe\", \"regsvcs.exe\", \"regsvr32.exe\", \"sc.exe\", \"schtasks.exe\",\n                   \"systeminfo.exe\", \"tracert.exe\", \"wmic.exe\", \"wscript.exe\",\"xwizard.exe\", \"explorer.exe\", \"msdt.exe\") and\n not (process.name : \"powershell.exe\" and process.args : \"-ExecutionPolicy\" and process.args : \"?:\\\\TeamCity\\\\buildAgent\\\\work\\\\*.ps1\") and\n not (process.name : \"cmd.exe\" and process.args : \"dir\" and process.args : \"/-c\")","logSource":"Windows process creation (Elastic Defend, Sysmon, 4688)","author":"Elastic","authorUrl":"https://github.com/elastic/detection-rules","sourceUrl":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules/windows/initial_access_exploit_jetbrains_teamcity.toml","sourceDate":"2026-09-18","license":"Elastic License 2.0","origin":"vendor","tested":"untested"},{"id":"et-teamcity-admin-user-creation","title":"ET WEB_SPECIFIC_APPS JetBrains TeamCity Authentication Bypass Attempt (CVE-2024-27198) - Admin User Creation Attempt","language":"suricata","query":"alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:\"ET WEB_SPECIFIC_APPS JetBrains TeamCity Authentication Bypass Attempt (CVE-2024-27198) - Admin User Creation Attempt\"; flow:established,to_server; http.method; content:\"POST\"; http.uri; content:\"jsp|3d|/app/rest/users\"; fast_pattern; content:\".jsp\"; within:30; http.request_body; content:\"|7b|\"; startswith; content:\"|22|username|22 3a 20 22|\"; content:\"|22|password|22 3a 20 22|\"; content:\"|5b 7b 22|roleId|22 3a 20 22|SYSTEM_ADMIN\"; reference:cve,2024-27198; reference:url,www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/; classtype:attempted-admin; sid:2051506; rev:5; metadata:affected_product JetBrains_TeamCity, created_at 2024_03_06, cve CVE_2024_27198, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag JetBrains_TeamCity, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_08_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)","logSource":"Suricata IDS alerts (ET Open ruleset)","author":"Emerging Threats (Proofpoint)","authorUrl":"https://rules.emergingthreats.net/","sourceUrl":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-web_specific_apps.rules","sourceDate":"2025-08-11","license":"BSD-3-Clause (ET Open, sids 2000000-2799999)","origin":"vendor","tested":"untested"},{"id":"et-teamcity-27199-path-traversal-check","title":"ET WEB_SPECIFIC_APPS JetBrains TeamCity Authentication Bypass Attempt (CVE-2024-27199) - Vulnerability Check","language":"suricata","query":"alert http any any -> $HOME_NET any (msg:\"ET WEB_SPECIFIC_APPS JetBrains TeamCity Authentication Bypass Attempt (CVE-2024-27199) - Vulnerability Check\"; flow:established,to_server; http.method; content:\"GET\"; http.uri; pcre:\"/^\\x2f(res|update|\\x2ewell-known\\x2facme-challenge)\\x2f/\"; content:\"|2e 2e|\"; content:\"/admin/diagnostic.jsp\"; fast_pattern; endswith; reference:cve,2024-27199; reference:url,www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/; classtype:attempted-recon; sid:2051508; rev:2; metadata:affected_product JetBrains_TeamCity, created_at 2024_03_06, cve CVE_2024_27199, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag JetBrains_TeamCity, tag CVE_2024_27199, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)","logSource":"Suricata IDS alerts (ET Open ruleset)","author":"Emerging Threats (Proofpoint)","authorUrl":"https://rules.emergingthreats.net/","sourceUrl":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-web_specific_apps.rules","sourceDate":"2024-11-26","license":"BSD-3-Clause (ET Open, sids 2000000-2799999)","origin":"vendor","tested":"untested"},{"id":"v2s-sigma-teamcity-jsp-path-parameter","title":"TeamCity Authentication Bypass URI Pattern","language":"sigma","query":"title: TeamCity Authentication Bypass URI Pattern\nid: 89a3b09d-4252-59f1-8eeb-d6e115f66ea5\nstatus: experimental\ndescription: Detects requests whose query string carries a jsp= parameter plus a ';' path parameter ending in .jsp, the URI shape Rapid7 documents for CVE-2024-27198 against JetBrains TeamCity.\nreferences:\n    - https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/\nauthor: vuln2shell\ndate: 2026-10-23\ntags:\n    - attack.initial-access\n    - attack.t1190\n    - cve.2024-27198\nlogsource:\n    category: webserver\ndetection:\n    selection:\n        cs-uri-query|contains|all:\n            - 'jsp='\n            - ';'\n            - '.jsp'\n    condition: selection\nfalsepositives:\n    - Unlikely on TeamCity servers\nlevel: high","logSource":"Reverse-proxy or web access logs in front of TeamCity","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","sourceDate":"2024-03-04","license":"CC0 1.0","origin":"vuln2shell","notes":"Matches the attacker's original URI as logged by a proxy.","tested":"untested"},{"id":"v2s-logscale-teamcity-javalogging-rewrite","title":"Rewritten bypass URI in teamcity-javaLogging (LogScale)","language":"logscale","query":"/;\\S*\\.jsp\\?\\S*jsp=/\n| groupBy([@host], function=count())","logSource":"TeamCity teamcity-javaLogging log files ingested into LogScale","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","sourceDate":"2024-03-04","license":"CC0 1.0","origin":"vuln2shell","notes":"Uses the exact regex Rapid7 suggests for the rewritten URI in teamcity-javaLogging.","tested":"untested"},{"id":"v2s-kql-teamcity-java-spawns-shell","title":"TeamCity server Java process spawns a shell (Defender)","language":"kql","query":"DeviceProcessEvents\n| where Timestamp > ago(30d)\n| where InitiatingProcessFileName =~ \"java.exe\" and InitiatingProcessFolderPath has \"TeamCity\"\n| where FileName in~ (\"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"certutil.exe\", \"whoami.exe\", \"net.exe\")\n| project Timestamp, DeviceName, InitiatingProcessFolderPath, FileName, ProcessCommandLine, AccountName","logSource":"Microsoft Defender for Endpoint DeviceProcessEvents (Windows)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules/windows/initial_access_exploit_jetbrains_teamcity.toml","sourceDate":"2026-09-18","license":"CC0 1.0","origin":"vuln2shell","notes":"KQL port of a subset of Elastic's Suspicious JetBrains TeamCity Child Process rule. Build steps can run shells, so exclude build agents.","tested":"untested"}],"detectionLinks":[{"title":"Rapid7: CVE-2024-27198 and CVE-2024-27199 analysis (log regexes)","url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","author":"Rapid7","date":"2024-03-04"},{"title":"Splunk: JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199","url":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199.yml","author":"Splunk Threat Research Team"},{"title":"Splunk: Windows TeamCity Payload Execution From Temp Directory","url":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/endpoint/windows_teamcity_payload_execution_from_temp_directory.yml","author":"Splunk Threat Research Team"},{"title":"ET Open emerging-web_specific_apps.rules (TeamCity sids 2051505 to 2051512)","url":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-web_specific_apps.rules","author":"Emerging Threats","date":"2025-08-11"}],"retrohunt":{"summary":"Search TeamCity Java and activity logs back to at least 4 Mar 2024 for rewritten URIs with ;.jsp and jsp=, then look for access-token creation, new admin users and plugin upload/delete pairs by the same account.","lookback":{"from":"2024-03-04","basis":"public-disclosure","rationale":"Public details and PoCs landed with Rapid7 on 4 Mar 2024. Dark Reading reports LeakIX seeing rogue accounts by 7 Mar 2024. Rapid7 first contacted JetBrains on 15 Feb 2024; if the server was internet-facing earlier, extend the window.","sources":[{"url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","publisher":"Rapid7"},{"url":"https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive","date":"2024-03-07","publisher":"Dark Reading"}]},"logSources":[{"name":"teamcity-javaLogging*.log","why":"Shows the rewritten request URI with ;.jsp and jsp=.","required":true},{"name":"teamcity-server.log and teamcity-activities.log","why":"Record token create/delete, new users and plugin upload/delete.","required":true},{"name":"Proxy or WAF logs in front of TeamCity","why":"Show the original URI if Java logs were rotated away.","required":false},{"name":"EDR on the TeamCity host","why":"Shows java spawning shells or tools after a malicious plugin runs.","required":false}],"steps":[{"title":"Search Java logs for the bypass URI shape","detail":"Rapid7 shows rewritten URIs containing ;.jsp and jsp=. Search for ;*.jsp?*jsp=.","sources":[{"url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","publisher":"Rapid7"}]},{"title":"Look for token and user creation","detail":"teamcity-server.log and teamcity-activities.log record create_token_for_user, delete_token_for_user and New user created. Note the user id.","sources":[{"url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","publisher":"Rapid7"}]},{"title":"Look for plugin upload then delete by the same user","detail":"Rapid7 shows plugin_uploaded and plugin_deleted in quick succession under the same user id after a Metasploit-style attack.","sources":[{"url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","publisher":"Rapid7"}]},{"title":"Check residual plugin files","detail":"Look under Catalina work directories, webapps/ROOT/plugins and plugins.unpacked for leftover plugin content after a delete.","sources":[{"url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","publisher":"Rapid7"}]},{"title":"Audit the TeamCity console","detail":"Review the Audit page for unexpected administrators and access tokens.","sources":[{"url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","publisher":"Rapid7"}]}],"queries":[{"id":"v2s-rh-spl-teamcity-jsp","title":"TeamCity ;.jsp / jsp= URI rewrites since 4 Mar 2024","language":"spl","query":"index=* (sourcetype=*teamcity* OR source=\"*teamcity-javaLogging*\") earliest=\"03/04/2024:00:00:00\"\n| regex _raw=\";\\S*\\.jsp\\?\\S*jsp=\"\n| stats count min(_time) as firstTime max(_time) as lastTime by host\n| convert ctime(firstTime) ctime(lastTime)","logSource":"TeamCity Java logs in Splunk","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","sourceDate":"2024-03-04","license":"CC0 1.0","origin":"vuln2shell","notes":"Regex from Rapid7.","tested":"untested","timeRange":"From 2024-03-04"},{"id":"v2s-rh-logscale-teamcity-jsp","title":"TeamCity ;.jsp / jsp= URI rewrites","language":"logscale","query":"// Set the time picker to start 2024-03-04\n/;\\S*\\.jsp\\?\\S*jsp=/\n| groupBy([#host], function=[count(), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])","logSource":"TeamCity Java logs in LogScale","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","sourceDate":"2024-03-04","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2024-03-04"},{"id":"v2s-rh-kql-teamcity-java-shell","title":"TeamCity java process spawning shells since 4 Mar 2024","language":"kql","query":"DeviceProcessEvents\n| where Timestamp >= datetime(2024-03-04)\n| where InitiatingProcessFileName =~ \"java.exe\" and InitiatingProcessFolderPath has \"TeamCity\"\n| where FileName in~ (\"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"certutil.exe\", \"whoami.exe\", \"net.exe\")\n| project Timestamp, DeviceName, InitiatingProcessFolderPath, FileName, ProcessCommandLine, AccountName","logSource":"Microsoft Defender for Endpoint DeviceProcessEvents (Windows)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","sourceDate":"2024-03-04","license":"CC0 1.0","origin":"vuln2shell","notes":"Builds that shell out by design will also match; filter by known CI tasks.","tested":"untested","timeRange":"From 2024-03-04, limited by retention"}],"thirdPartyQueries":[{"title":"JetBrains TeamCity Authentication Bypass Suricata detections","url":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/jetbrains_teamcity_authentication_bypass_cve_2024_27198.yml","author":"Splunk Threat Research","date":null,"language":"spl","license":"Apache-2.0","origin":"vendor","note":"Already linked from Detection."}],"artefacts":[{"kind":"device-log","value":";*.jsp?*jsp= in teamcity-javaLogging","detail":"URI rewrite after a successful bypass.","sourceUrl":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","sourceDate":"2024-03-04"},{"kind":"device-log","value":"create_token_for_user / delete_token_for_user / New user created","detail":"Post-bypass account and token activity.","sourceUrl":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","sourceDate":"2024-03-04"},{"kind":"device-log","value":"plugin_uploaded then plugin_deleted by the same user id","detail":"Malicious plugin used for code execution.","sourceUrl":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","sourceDate":"2024-03-04"},{"kind":"file","value":"Unexpected plugin directories under work/ or plugins.unpacked","detail":"Residue after a deleted plugin.","sourceUrl":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","sourceDate":"2024-03-04"}],"iocs":[],"iocNote":"No fixed public IOC list. Hunt on the URI shape, account and plugin events.","hitMeaning":[{"level":"attempt","detail":"A ;.jsp / jsp= request with no follow-on token or user creation."},{"level":"likely-compromise","detail":"Token or admin user creation by an unexpected account, or a plugin upload/delete pair."},{"level":"confirmed-compromise","detail":"A malicious plugin ran, or java spawned an unexpected shell."}],"nextSteps":[{"title":"Upgrade and rotate","detail":"Upgrade to 2023.11.4 or later, revoke tokens, remove rogue users and plugins, and rotate secrets the server could reach.","links":[{"label":"JetBrains advisory","href":"https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/"}]},{"title":"Assume CI compromise","detail":"Review build agents, stored credentials and deployments from the first hit onward."}],"limits":["teamcity-javaLogging rotates quickly on busy servers.","Legitimate plugin installs look similar; check who did them and when."],"sources":[{"url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","publisher":"Rapid7"},{"url":"https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive","date":"2024-03-07","publisher":"Dark Reading"},{"url":"https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/","date":"2024-03-04","publisher":"JetBrains"}],"updatedAt":"2026-10-24"},"amIAffected":{"summary":"All TeamCity On-Premises versions through 2023.11.3 are affected until 2023.11.4 or the JetBrains security patch plugin is in place. JetBrains states TeamCity Cloud was already patched and was not attacked.","checks":[{"id":"v2s-aia-teamcity-auth-bypass-version-1","kind":"version","title":"Read the TeamCity On-Premises version","detail":"JetBrains: all On-Premises versions through 2023.11.3; fixed in 2023.11.4. Rapid7: both CVEs affect all versions prior to 2023.11.4. Read the version from Administration or the startup banner in teamcity-server.log. Rapid7 default log paths: C:\\TeamCity\\logs\\ on Windows, /opt/TeamCity/logs/ on Linux. Do not use the unauthenticated /app/rest/server bypass as a version check.","command":"Select-String -Path 'C:\\TeamCity\\logs\\teamcity-server.log','/opt/TeamCity/logs/teamcity-server.log' -Pattern 'version' -SimpleMatch | Select-Object -First 20","affectedMeans":"On-Premises version string through 2023.11.3 (Rapid7 example: 2023.11.3 build 147512) and the security patch plugin is not installed.","fixedMeans":"2023.11.4 or later, or JetBrains security patch plugin installed on 2018.2+ or 2018.1-and-older as JetBrains packaged it.","sources":[{"url":"https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/","date":"2024-03-04","publisher":"JetBrains"},{"url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","publisher":"Rapid7"}]},{"id":"v2s-aia-teamcity-auth-bypass-package-2","kind":"package","title":"Confirm the JetBrains security patch plugin if you did not upgrade","detail":"JetBrains mitigation option 2: security patch plugin for all versions through 2023.11.3, with separate downloads for TeamCity 2018.2 and newer vs 2018.1 and older. The plugin only patches these two CVEs. Inventory installed plugins in Administration > Plugins.","command":"In TeamCity Administration > Plugins, confirm the JetBrains security patch plugin is present and enabled. Also review C:\\ProgramData\\JetBrains\\TeamCity\\config\\disabled-plugins.xml (Windows path from Rapid7) for unexpected disabled-plugin names.","affectedMeans":"Version <= 2023.11.3 and the security patch plugin is absent or disabled.","fixedMeans":"Plugin installed and enabled, or server version is 2023.11.4 or later.","sources":[{"url":"https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/","date":"2024-03-04","publisher":"JetBrains"},{"url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","publisher":"Rapid7"}]},{"id":"v2s-aia-teamcity-auth-bypass-exposure-3","kind":"exposure","title":"Internet-facing TeamCity HTTP(S) in your ranges","detail":"Rapid7: TeamCity exposes a web server over HTTP port 8111 by default (HTTPS optional). CVE-2024-27198 needs unauthenticated HTTP(S) access. Catalog Shodan query http.component:\"TeamCity\". JetBrains: if the server is publicly accessible and you cannot immediately upgrade or plugin-patch, make it inaccessible until mitigation is done.","command":"shodan search 'http.component:\"TeamCity\" net:<your-range>'","affectedMeans":"A TeamCity HTTP(S) listener in your net or org on a version through 2023.11.3 without the plugin.","fixedMeans":"No public TeamCity management port, or every hit is 2023.11.4+ or plugin-patched.","sources":[{"url":"https://www.shodan.io/search?query=http.component%3A%22TeamCity%22","date":"2026-10-23","publisher":"Shodan (catalog snapshot)"},{"url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","publisher":"Rapid7"},{"url":"https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/","date":"2024-03-04","publisher":"JetBrains"}]}],"limits":["teamcity-server.log version lines can rotate away on busy servers.","TeamCity Cloud is vendor-stated already patched. On-Premises is not.","A plugin install does not remove rogue admin users created before it was applied."],"sources":[{"url":"https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/","date":"2024-03-04","publisher":"JetBrains"},{"url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","publisher":"Rapid7"},{"url":"https://www.shodan.io/search?query=http.component%3A%22TeamCity%22","date":"2026-10-23","publisher":"Shodan (catalog snapshot)"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"mitigations":{"summary":"JetBrains documents a security patch plugin when you cannot upgrade to 2023.11.4, and taking the server off the internet until you can. The plugin does not undo rogue admins or malicious plugins already installed.","items":[{"title":"Install the JetBrains security patch plugin when you cannot upgrade","detail":"JetBrains mitigation option 2: download the security patch plugin (2018.2 and newer, or 2018.1 and older) and install it on all TeamCity versions through 2023.11.3. It patches CVE-2024-27198 and CVE-2024-27199 only. JetBrains still recommends upgrading to 2023.11.4.","limits":"Does not undo admin users, tokens, or malicious plugins already created. Not a backport of other security fixes.","verify":"Administration > Plugins shows the security patch plugin enabled. Version page still shows the old train, which is expected.","source":{"url":"https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/","date":"2024-03-04","publisher":"JetBrains"}},{"title":"Make the TeamCity HTTP(S) interface inaccessible until upgraded or plugin-patched","detail":"JetBrains: if your server is publicly accessible over the internet and you cannot immediately perform a mitigation step, make your server inaccessible until mitigation actions have been completed.","limits":"Does not remove persistence already planted. Blocks new unauthenticated access only.","verify":"shodan search 'http.component:\"TeamCity\" net:<your-range>' returns none; local listen on 8111/443 is bound only to trusted interfaces.","source":{"url":"https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/","date":"2024-03-04","publisher":"JetBrains"}}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"response":{"summary":"Assume compromise if the server was internet-facing while vulnerable. LeakIX reported rogue administrator accounts. Rapid7 documents malicious plugin unpack paths and audit-log artefacts.","containment":[{"title":"Assume compromise if the server was internet-facing while vulnerable","detail":"Dark Reading 2024-03-07: LeakIX reported 1,442 of 1,711 exposed instances showed rogue user accounts via CVE-2024-27198. LeakIX quoted: if you were or are still running a vulnerable system, assume compromise. Shadowserver saw exploitation starting 2024-03-04.","sources":[{"url":"https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive","date":"2024-03-07","publisher":"Dark Reading"}]},{"title":"Take the management interface off untrusted networks","detail":"JetBrains inaccessible-until-mitigated guidance. Then upgrade or install the plugin.","sources":[{"url":"https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/","date":"2024-03-04","publisher":"JetBrains"}]}],"rotate":[{"item":"TeamCity access tokens and administrator passwords","reason":"Rapid7: unauthenticated attacker can create a SYSTEM_ADMIN user or an administrator access token via /app/rest/users. Review Audit for user_create, create_token_for_user, delete_token_for_user.","sources":[{"url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","publisher":"Rapid7"}]},{"item":"HTTPS certificate and listen port if CVE-2024-27199 may have been used","reason":"Rapid7: unauthenticated attacker can upload a replacement HTTPS certificate and change the HTTPS port via /res/../app/https/settings/uploadCertificate and related /app/https/settings/* endpoints.","sources":[{"url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","publisher":"Rapid7"}]},{"item":"Secrets the TeamCity server and agents can reach (VCS tokens, deployment credentials, artifact-signing keys)","reason":"Rapid7 impact: complete control of projects, builds, agents, and artifacts; suitable vector for a supply chain attack. Rotate anything the server could use after the first rogue admin event.","sources":[{"url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","publisher":"Rapid7"}]}],"persistence":[{"kind":"account","value":"Unexpected TeamCity administrator users and access tokens","detail":"Rapid7: New user created / user_create in teamcity-server.log and teamcity-activities.log. Dark Reading / LeakIX: mass rogue admin creation. Names are attacker-chosen.","sourceUrl":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","sourceDate":"2024-03-04"},{"kind":"path","value":"C:\\ProgramData\\JetBrains\\TeamCity\\plugins\\<name>.zip and plugins.unpacked\\<name>\\ (Linux: /home/teamcity/.BuildServer/system/caches/plugins.unpacked/)","detail":"Rapid7: plugin_uploaded then plugin_deleted in quick succession by the same user id after a Metasploit-style attack. Attacker chooses the plugin name.","sourceUrl":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","sourceDate":"2024-03-04"},{"kind":"path","value":"C:\\TeamCity\\work\\Catalina\\localhost\\ROOT\\TC_<buildNumber>_<pluginName>\\ and C:\\TeamCity\\webapps\\ROOT\\plugins\\<pluginName>\\","detail":"Rapid7 residual plugin artefacts after delete. Linux: /opt/TeamCity/work/Catalina/localhost/ROOT/ and /opt/TeamCity/webapps/ROOT/plugins/.","sourceUrl":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","sourceDate":"2024-03-04"},{"kind":"other","value":"C:\\ProgramData\\JetBrains\\TeamCity\\config\\disabled-plugins.xml","detail":"Rapid7: disabling a plugin before delete leaves a permanent disabled-plugin entry.","sourceUrl":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","sourceDate":"2024-03-04"}],"evidence":[{"title":"teamcity-javaLogging rewritten URI with ;.jsp and jsp=","detail":"Rapid7 regex for rewritten URI: ;\\S*\\.jsp\\?\\S*jsp= . Default logs: C:\\TeamCity\\logs\\ or /opt/TeamCity/logs/. Also search proxy logs for the original /hax?jsp=/app/rest/...;.jsp shape if present.","sources":[{"url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","publisher":"Rapid7"}]},{"title":"teamcity-server.log, teamcity-activities.log, and the Audit page","detail":"Look for create_token_for_user, delete_token_for_user, plugin_uploaded, plugin_disable, plugin_deleted, New user created / user_create. Audit is also in buildserver.data (Rapid7 paths given).","sources":[{"url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","publisher":"Rapid7"}]},{"title":"Preserve the data directory and plugin trees before cleanup","detail":"Copy ProgramData\\JetBrains\\TeamCity or ~/.BuildServer, Catalina work, webapps/ROOT/plugins, and logs from 2024-03-04 (public details) or earlier if the server was internet-facing.","sources":[{"url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","publisher":"Rapid7"}]},{"title":"Standard IR artifacts before rebuild","detail":"Disk image, EDR process history for java.exe under TeamCity spawning shells (Elastic/catalog hunts), agent inventories, deployment history.","generic":true}],"sources":[{"url":"https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive","date":"2024-03-07","publisher":"Dark Reading"},{"url":"https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/","date":"2024-03-04","publisher":"JetBrains"},{"url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","publisher":"Rapid7"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"bulletins":[{"vendor":"Check Point","title":"CPAI-2024-0104 JetBrains TeamCity Authentication Bypass (CVE-2024-27198)","url":"https://advisories.checkpoint.com/defense/advisories/public/2024/cpai-2024-0104.html/","date":"2024-03-06","cve":"CVE-2024-27198"},{"vendor":"Cisco Talos","title":"Snort Talos Rules 2024-04-23","url":"https://www.snort.org/advisories/talos-rules-2024-04-23","date":"2024-04-23","cve":"CVE-2024-27199"},{"vendor":"Citrix","title":"NetScaler signature update version 126","url":"https://docs.netscaler.com/en-us/citrix-adc/13-1/signature-alerts/signature-update-version-126.html","date":"2026-10-23","cve":"CVE-2024-27198","dateKind":"checked"},{"vendor":"Cloudflare","title":"Cloudflare WAF changelog 2024 (historical)","url":"https://developers.cloudflare.com/waf/change-log/historical-2024/","date":"2024-03-18","cve":"CVE-2024-27198"},{"vendor":"F5","title":"F5 Distributed Cloud attack signatures reference","url":"https://docs.cloud.f5.com/docs-v2/platform/reference/attack-signatures","date":"2024-04-04","cve":"CVE-2024-27198"},{"vendor":"Fortinet","title":"FortiGuard search: CVE-2024-27198","url":"https://www.fortiguard.com/search?q=CVE-2024-27198&engine=1","date":"2024-03-12","cve":"CVE-2024-27198"},{"vendor":"Fortinet","title":"FortiGuard search: CVE-2024-27199","url":"https://www.fortiguard.com/search?q=CVE-2024-27199&engine=1","date":"2024-03-12","cve":"CVE-2024-27199"},{"vendor":"Juniper","title":"HTTP:CTS:JB-TEAM-CITY-AUTH-BYPS","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:CTS:JB-TEAM-CITY-AUTH-BYPS.html","date":"2024-03-07","cve":"CVE-2024-27198"},{"vendor":"Netskope","title":"ET WEB_SPECIFIC_APPS JetBrains TeamCity Authentication Bypass Attempt (CVE-2024-27198) (library entry, undated)","url":"https://threatlabs.netskope.com/library/ips/et-web-specific-apps-jetbrains-teamcity-authentication-bypass-attempt-cve-2024-27198-vulnerability-check/","date":"2026-10-23","cve":"CVE-2024-27198","dateKind":"checked"},{"vendor":"Trend Micro","title":"TeamCity Vulnerability Exploits Lead to Jasmin Ransomware, Other Malware Types","url":"https://www.trendmicro.com/en/research/24/c/teamcity-vulnerability-exploits-lead-to-jasmin-ransomware.html","date":"2026-10-23","cve":"CVE-2024-27198, CVE-2024-27199"}],"coverage":[{"title":"Additional Critical Security Issues Affecting TeamCity On-Premises","publisher":"JetBrains","url":"https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/","date":"2024-03-04","type":"vendor"},{"title":"JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities","publisher":"Rapid7","url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","date":"2024-03-04","type":"research"},{"title":"JetBrains TeamCity Mass Exploitation Underway, Rogue Accounts Thrive","publisher":"Dark Reading","url":"https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive","date":"2024-03-07","type":"news"},{"title":"Metasploit: JetBrains TeamCity Unauthenticated RCE","publisher":"Rapid7","url":"https://www.rapid7.com/db/modules/exploit/multi/http/jetbrains_teamcity_rce_cve_2024_27198/","date":"2024-03-04","type":"research"}],"posts":[],"research":[{"title":"JetBrains TeamCity advisory blog","url":"https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/","authors":"Daniel Gallo / JetBrains","date":"2024-03-04"},{"title":"Rapid7 technical analysis","url":"https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/","authors":"Stephen Fewer / Rapid7","date":"2024-03-04"},{"title":"NVD CVE-2024-27198","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27198","authors":"NVD","date":"2024-03-04"},{"title":"Dark Reading mass-exploitation report","url":"https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive","authors":"Dark Reading","date":"2024-03-07"}],"impact":{"kind":"single-product","product":"JetBrains TeamCity On-Premises","versions":[{"version":"TeamCity On-Premises through 2023.11.3","status":"affected","versions":"2023.11.4","vendorStatement":{"date":"2024-03-04","url":"https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/","quote":"The vulnerabilities affect all TeamCity On-Premises versions through 2023.11.3. They have been fixed in version 2023.11.4."}},{"version":"TeamCity Cloud","status":"vendor-stated-not-affected","vendorStatement":{"date":"2024-03-04","url":"https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/","quote":"TeamCity Cloud servers have already been patched, and we have verified that they weren't attacked."}}]},"pocs":[{"title":"W01fh4cker/CVE-2024-27198-RCE","url":"https://github.com/W01fh4cker/CVE-2024-27198-RCE","source":"W01fh4cker","validationStatus":"validated","validationDate":"2024-03-06","notes":"Public repository created 6 Mar 2024. Description covers CVE-2024-27198 and CVE-2024-27199 authentication bypass to RCE."},{"title":"Metasploit module jetbrains_teamcity_rce_cve_2024_27198","url":"https://www.rapid7.com/db/modules/exploit/multi/http/jetbrains_teamcity_rce_cve_2024_27198/","source":"Rapid7 Metasploit","validationStatus":"validated","validationDate":"2024-03-04","notes":"Official Metasploit module page describing unauthenticated admin token/plugin RCE."}],"_feed":{"page":"https://vuln2shell.com/vulns/teamcity-auth-bypass","json":"https://vuln2shell.com/vulns/teamcity-auth-bypass.json","iocsCsv":"https://vuln2shell.com/vulns/teamcity-auth-bypass/iocs.csv","stix":"https://vuln2shell.com/vulns/teamcity-auth-bypass/stix.json"}}