Two vulnerabilities with publicly available exploit code in JetBrains TeamCity on-premises software could result in attackers bypassing authentication and achieving code execution.

Background

On March 4, JetBrains published a blog post regarding two security issues affecting TeamCity On-Premises, a software solution for build management. The issues were disclosed to JetBrains in February by the researchers who discovered these vulnerabilities. In the March 4 release notes, no mention was made of what security issues were patched, however later in the day, a blog post regarding the release of TeamCity 2023.11.4 was published which included details about the two vulnerabilities.

Analysis

CVE-2024-27198 is an authentication bypass vulnerability with a critical CVSSv3 rating of 9.8. The vulnerability is within the web component of TeamCity and stems from an alternate path issue. Exploitation of this vulnerability could allow an attacker to bypass authentication in order to take administrative control of an affected TeamCity server. With this level of access, the attacker could execute arbitrary code and abuse this access for a supply chain attack.

CVE-2024-27199 is another authentication bypass vulnerability in the web component of TeamCity, made possible by a path traversal issue. The vulnerability received a CVSSv3 score of 7.3 and while this vulnerability is less severe, it can still be abused by an unauthenticated attacker.

These CVE alerts are primarily a concern for organizations running on-premises installations of TeamCity, and it is crucial that administrators of on-premises servers take steps to update their systems immediately. JetBrains has confirmed TeamCity Cloud customers have already had their servers patched, and have confirmed no evidence of exploitation has occurred for cloud customers.

Historical exploitation of TeamCity vulnerabilities

Unfortunately, this is not the first authentication bypass vulnerability to impact TeamCity servers. CVE-2023-42793, another authentication bypass vulnerability patched in September, saw a variety of exploitation attempts within days of exploit details being released. In October, it was claimed that state sponsored North Korean hackers were responsible for impersonating IT workers and attacking software developers via CVE-2023-42793.

Shortly after, in December, law enforcement from Poland, the United States, and the United Kingdom warned that CVE-2023-42793 was being used by Russian state sponsored groups to target unpatched instances of TeamCity servers. APT 29, also known as Cozy Bear, is a threat actor well known for supply chain and malware attacks across a variety of industries and sectors including energy companies and political organizations. Their abuse of CVE-2023-42793 and the exploitation from a wide range of threat actor groups are a reminder of the severe damage that can be inflicted in well organized attacks. We expect to see continued attacks on TeamCity instances and organizations running vulnerable versions of TeamCity should take the latest warnings seriously and remediate these vulnerabilities as soon as possible.

Exploitation has been observed

In a post on X (formerly Twitter), LeakIX revealed that they have observed over 1400 instances of compromised TeamCity servers with evidence of “clear signs of rogue user creation.”

⚠️We added detection for compromised #TeamCity instances:

1711 vulnerable instances were found during our last scan, 1442 show clear signs of rogue user creation.

If you were/are still running a vulnerable system, assume compromise. pic.twitter.com/BIvscjRxZJ

— LeakIX (@leak_ix) March 6, 2024

With in-the-wild exploitation already underway, it’s imperative to take action to remediate these vulnerabilities as well as begin incident response processes to identify if your server has been compromised.

Proof of concept

At the time this blog was published, public proof-of-concept (PoC) code is available. Additionally, active exploitation attempts of CVE-2024-27198 have been observed.

If running JetBrains TeamCity on-prem – make sure to patch for latest CVE-2024-27198 (remote auth bypass) & CVE-2024-27199 vulns NOW! 

We started seeing exploitation activity for CVE-2024-27198 around Mar 4th 22:00 UTC. 16 IPs seen scanning so far.https://t.co/zZ0iU5MD8S

— Shadowserver (@Shadowserver) March 5, 2024

Solution

JetBrains has released TeamCity version 2023.11.4 to address both of these authentication bypass vulnerabilities.

JetBrains advises customers to update or patch as soon as possible. In situations where either of these options are not available and devices are internet facing, JetBrains recommends taking impacted devices offline until the patch can be applied.

In instances where upgrading to version 2023.11.4 is not possible, JetBrains offers a standalone security patch, with versions available for TeamCity 2018.2 and newer as well as TeamCity 2018.1 and older.

With public PoC code available and historical exploitation of TeamCity servers, we recommend patching or updating your installation as soon as possible.

Identifying affected systems

A list of Tenable plugins to identify affected systems can be found on the individual CVE pages for CVE-2024-27198 and CVE-2024-27199. This link will display all available plugins for these vulnerabilities, including upcoming plugins in our Plugins Pipeline.

Get more information

Join Tenable’s Security Response Team on the Tenable Community.

Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.