CVE-2024-27199: JetBrains TeamCity Unauthenticated Path Traversal Enables Admin Actions

Background

JetBrains TeamCity is a CI/CD platform used by software development teams to automate build, test, and deployment pipelines. Its centrally managed configuration, build agents, and VCS integrations give it access to source code repositories, signing keys, deployment credentials, and cloud API tokens across every connected project. Thousands of organisations in defence contracting, financial services, and software development rely on TeamCity to gate code into production environments.

Compromising a CI/CD server is high-impact by design: attackers can inject malicious code into software builds, harvest credentials for every connected system, and use the deployment pipeline as a delivery mechanism. That attack surface was demonstrated in 2023 when CVE-2023-42793, an authentication bypass in TeamCity, was exploited by APT29 (Cozy Bear) at scale, affecting thousands of organisations globally.

CVE-2024-27199 is a companion vulnerability to CVE-2024-27198, a more severe authentication bypass disclosed simultaneously in March 2024. CVE-2024-27198 gave complete authentication bypass; CVE-2024-27199 uses a path traversal flaw to reach certain administrative endpoints without authentication — a narrower capability, but still significant given TeamCity’s position in software delivery pipelines.

Technical Mechanism

The vulnerability is classified as CWE-22 (Path Traversal) / CWE-23 (Relative Path Traversal). TeamCity’s web server maps incoming request paths to handler classes. The authentication filter, which intercepts requests and validates session tokens before passing them to handlers, applies allow-listing rules based on URL path prefixes. Certain paths are allow-listed as publicly accessible (e.g., login pages, health endpoints) and bypass authentication checks.

The flaw lies in how the authentication filter normalises URL paths before matching them against the allow-list. By supplying a crafted URL containing path traversal sequences (e.g., ..;/ or %2e%2e;/), an attacker can construct a request that the authentication filter classifies as an allow-listed path but that the servlet container routes to a protected handler:

GET /res/../admin/someAdminEndpoint HTTP/1.1

The authentication filter processes /res/... and determines it is an allowed resource path. The servlet container normalises the full path to /admin/someAdminEndpoint and routes it to the administrative handler, which executes without having verified authentication.

The administrative endpoints reachable via this technique are limited — the vulnerability does not provide complete authentication bypass — but they include endpoints that can perform sensitive configuration reads and limited administrative actions. Combined with CVE-2024-27198 or other techniques, or when the reachable endpoints expose sensitive information like user tokens, the impact escalates significantly.

The CVSS 7.3 score reflects the partial impact profile (C:L/I:L/A:L) — the reachable endpoints are limited, not full compromise — but the vulnerability is network-accessible, requires no authentication, and requires no user interaction.

Real-World Exploitation Evidence

CVE-2024-27199 and its companion CVE-2024-27198 were disclosed in March 2024 and attracted immediate exploitation interest. CISA’s 2026 KEV addition reflects continued exploitation of unpatched TeamCity instances — a recurring problem in the CI/CD ecosystem where patch cycles are deprioritised due to concerns about pipeline disruption during updates.

Exploitation patterns observed in the wild include:

• Reconnaissance and credential harvesting: Using the path traversal to reach endpoints that expose build configuration details, VCS integration tokens, or internal user information without authentication
• Chained exploitation: Using CVE-2024-27199 as a reconnaissance step before escalating to more impactful techniques against the same target
• Nation-state activity: Threat intelligence vendors have attributed TeamCity exploitation campaigns to Russian intelligence-affiliated groups (consistent with the APT29 pattern established in 2023) and North Korean actors seeking to compromise software development organisations
• Opportunistic scanning: Automated scanners probing for TeamCity instances and testing for the path traversal pattern, with credential-stuffing follow-on attacks against identified targets

Self-hosted TeamCity installations without automatic update mechanisms have a persistent problem with lagging patch adoption, which is why exploitation continues years after fixes are available.

Impact Assessment

• Unauthenticated access to administrative endpoints: Sensitive configuration data and user information reachable without credentials
• Build secret exposure: Tokens, passwords, and API keys stored in TeamCity build configurations may be accessible through reachable administrative endpoints
• Supply chain compromise potential: In the worst case, combined with other vulnerabilities or weak configurations, an attacker who gains full TeamCity access can inject malicious build steps into software pipelines affecting downstream software consumers
• VCS credential theft: TeamCity stores Version Control System credentials for repository access; these enable source code exfiltration
• Audit trail manipulation: Administrative access may allow attackers to cover their tracks by modifying or clearing audit logs
• Agent network access: TeamCity build agents often execute on internal network hosts; compromising the TeamCity server provides a pivot point to these systems

Affected Versions

Remediation Steps

1. Upgrade to TeamCity 2023.11.4: Apply the patch via the TeamCity server administration panel under Administration > TeamCity Server. JetBrains also released a security patch plugin for organisations unable to immediately upgrade the full server.

2. Apply the security patch plugin as an interim measure: JetBrains published a dedicated security patch plugin for CVE-2024-27198 and CVE-2024-27199 that can be installed without a full server upgrade. Install it via Administration > Plugins if upgrading is not immediately possible.

3. Restrict TeamCity server access: Ensure the TeamCity server UI and API (typically TCP/8111 or TCP/443) is accessible only from authorised developer networks, build agent networks, and administrative hosts. Remove any internet-facing exposure if not operationally required.

4. Audit for exploitation indicators: Review TeamCity access logs for requests containing ..;/, %2e%2e, or other path traversal patterns. Look for access to administrative endpoints from unauthenticated sessions (no valid session cookie).

5. Rotate stored credentials: If the server was internet-accessible while running a vulnerable version, rotate all VCS tokens, cloud provider credentials, and deployment keys stored in TeamCity build configurations.

6. Enable TeamCity audit logging: Ensure the TeamCity audit log (Administration > Audit Log) is retained and backed up to a location inaccessible from the TeamCity server itself, so log tampering by an attacker does not destroy forensic evidence.

Detection Guidance

Indicators to investigate:

• Access log entries containing ..;/, %2e%2e;/, %2F.., or similar path traversal patterns in the request URI
• Requests to administrative URL prefixes (/admin/, /app/, /httpAuth/) from clients without valid session cookies
• HTTP 200 responses to requests that should have returned 401 or 302 (redirect to login) based on the requested resource
• User creation events or configuration changes in the TeamCity audit log that cannot be attributed to authenticated administrator sessions
• Outbound connections from the TeamCity server to unexpected destinations, particularly shortly after anomalous inbound requests
• Unexpected new users in the TeamCity user list, particularly those with System Administrator privileges (a common persistence technique post-exploitation)

Timeline

References

• NVD — CVE-2024-27199
• CISA KEV — CVE-2024-27199
• MITRE CVE — CVE-2024-27199