CVE-2024-27199

CVE-2024-27199: JetBrains TeamCity Path Traversal Enables Limited Admin Actions

AI-generated analysis based on the vulnerability data on this page.

Summary

A path-traversal flaw in JetBrains TeamCity before 2023.11.4 enables unauthenticated remote attackers to reach restricted administrative endpoints by manipulating URL paths. Successful exploitation grants limited admin capabilities without valid credentials, exposing CI/CD pipelines to unauthorized access and supply-chain risk.

Background

JetBrains TeamCity is a widely adopted continuous integration and continuous deployment (CI/CD) server used by development teams to automate builds, tests, and releases. Because TeamCity often holds credentials to source-control systems, artifact repositories, and deployment targets, it is a high-value target for threat actors seeking to poison software supply chains. CVE-2024-27199 was disclosed in March 2024 alongside a related authentication-bypass vulnerability (CVE-2024-27198), and both quickly attracted mass exploitation.

Root Cause

The vulnerability is classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory. TeamCity’s web interface failed to adequately sanitize or canonicalize incoming URL paths before routing requests. By injecting directory-traversal sequences (e.g., ../ or encoded variants) into the request path, an attacker could bypass access-control checks that relied on literal path matching and reach protected administrative handlers. The root cause is therefore a validation gap at the request-dispatch layer rather than a flaw in a specific endpoint’s business logic.

Impact

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L translates to:

• Attack Vector: Network — Exploitable remotely without local network access.
• Attack Complexity: Low — No special conditions or race windows are required.
• Privileges Required: None — Fully unauthenticated.
• User Interaction: None — No victim action needed.
• Scope: Unchanged — The vulnerable component is the only one impacted.
• Confidentiality Impact: Low — Limited access to admin-level information.
• Integrity Impact: Low — Limited ability to alter configuration or data.
• Availability Impact: Low — Possible limited disruption, but not full denial of service.

The overall HIGH severity (7.3) is driven by the zero-authentication, network-reachable attack surface and the administrative privileges attainable, which in a CI/CD context can cascade into supply-chain compromise.

Exploitation Walkthrough

Ethics & Legal Notice: The following description is provided for defensive awareness and detection engineering only. Attempting to exploit systems without explicit authorization is illegal and unethical.

An attacker sends a crafted HTTP request to a publicly reachable TeamCity instance, embedding path-traversal sequences in the URI to reach an admin-restricted endpoint. Because the dispatcher does not canonicalize the path before evaluating access rules, the request is routed to the privileged handler and executed with elevated context. No valid session cookie or API token is required. Publicly available exploit code (e.g., RCity.py) automates this sequence, lowering the barrier for opportunistic attacks.

Defenders should treat any unauthenticated request containing .. or encoded traversal patterns targeting TeamCity URLs as suspicious, especially when the resulting response contains admin-page content or configuration data.

Affected and Patched Versions

Specific patch details are documented in JetBrains’ security advisory. If you are running a version older than 2023.11.4, assume exposure.

Remediation

1. Upgrade immediately to JetBrains TeamCity 2023.11.4 or the latest supported release. This is the primary and most effective remediation.
2. Apply compensating controls if patching is delayed:
   • Restrict network access to TeamCity web interfaces using VPNs, IP allow-lists, or Web Application Firewalls (WAFs).
   • Block or alert on URI paths containing traversal sequences (.., %2e%2e, %252e, etc.) at the reverse-proxy or WAF layer.
   • Disable or limit public exposure of the TeamCity server UI; require bastion host or jump-box access.
3. Rotate credentials after patching, especially CI/CD service accounts, source-control tokens, and deployment keys that TeamCity may have stored, in case of prior compromise.

Detection

• Network / WAF logs: Look for HTTP requests to TeamCity endpoints containing .. sequences, double-encoded traversal patterns, or anomalous 200-OK responses to unauthenticated admin paths.
• Web server logs: Unusually large numbers of 404 or 403 errors followed by 200 responses from the same source IP may indicate traversal probing followed by successful exploitation.
• Host-based monitoring: Unexpected changes to TeamCity configuration files, new user accounts, or modified build steps without a corresponding authenticated admin session are indicators of compromise.
• Threat-intelligence feeds: Correlate source IPs against known exploit frameworks or scanning campaigns associated with CVE-2024-27199.

Assessment

With an EPSS score of 0.99991, this vulnerability sits in the top fraction of a percentile for observed exploitation probability, and its presence on the CISA KEV catalog (added 2026-04-20) confirms in-the-wild abuse. The related CVE-2024-27198 authentication bypass amplifies the threat because attackers can chain the two flaws for broader impact.

Key lessons:

1. Path canonicalization is security-critical. Frameworks and custom dispatchers must resolve and normalize paths before applying access-control decisions.
2. CI/CD infrastructure is tier-0 infrastructure. A compromised build server is a compromised software supply chain; unauthenticated admin access to CI/CD systems should be considered a code-red event.

References

• https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive
• https://www.jetbrains.com/privacy-security/issues-fixed/
• https://github.com/Stuub/RCity-CVE-2024-27198/blob/main/RCity.py
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27199