erroneo.us
Search all guides⌘K

Security Digest · Mar 4, 2024 · Vulnerability · CI/CD

TeamCity CVE-2024-27198: Auth Bypass Used by Ransomware

Unauthenticated admin takeover of TeamCity On-Premises before 2023.11.4, mass-exploited in March 2024 with ransomware. Upgrade to a current release and hunt.

Published By erroneo.us Security Desk · Updated 3 min read7 sources

Our verdict

Check exposure

Any TeamCity server that was internet-reachable and below 2023.11.4 in March 2024 may have been taken over; upgrade to a current release (which also fixes 2026's CVE-2026-63077) and audit for rogue admins and plugins.

Who must act: Owners of self-hosted TeamCity servers that ran 2023.11.3 or older without the security patch plugin at any point after March 4, 2024, especially internet-facing ones.

Who can relax: TeamCity Cloud customers, whom JetBrains patched and says were not attacked, and on-prem servers that were patched promptly and are now on a current release.

Affected
TeamCity On-Premises, all versions through 2023.11.3
Fixed in
TeamCity 2023.11.4
Security patch plugin for TeamCity 2018.2 and newer, and a separate one for 2018.1 and older
Current releases (2025.11.7 or 2026.1.3 and later also fix CVE-2026-63077)
CVSS
9.8 (v3.1, CNA)
EPSS
99.9% (percentile 100.0)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Check the TeamCity version on every self-hosted server (shown in the web UI footer and under Administration).
  2. Upgrade to a current TeamCity release; 2023.11.4 fixes this bug, but 2025.11.7 or 2026.1.3 and later are needed for 2026's CVE-2026-63077.
  3. Keep the TeamCity web UI off the internet or behind a VPN or SSO proxy.
  4. Audit administrator accounts, access tokens and installed plugins, and remove anything you cannot explain.
  5. If compromise is likely, rebuild the server and agents and rotate every secret TeamCity holds (VCS tokens, cloud keys, signing keys, deployment credentials).

How to check if you are affected or compromised

  • Search teamcity-javaLogging-*.log for request URIs matching the regex ;\S*\.jsp\?\S*jsp= (Rapid7's indicator).
  • Search teamcity-activities.log and teamcity-server.log for user_create, plugin_uploaded, plugin_disable, plugin_deleted and delete_token_for_user events you cannot explain.
  • Check config/disabled-plugins.xml and the plugins directories for plugins nobody installed.
  • Look for the TeamCity java process spawning cmd.exe, PowerShell, certutil or msiexec, a new local 'Default$' admin account, or files renamed to .lsoc (Jasmin ransomware).

What happened#

On March 4, 2024, JetBrains disclosed two flaws in TeamCity On-Premises, its self-hosted CI/CD server, fixed in 2023.11.4. CVE-2024-27198 is an authentication bypass through an alternate path (CWE-288, CVSS 3.1 9.8). It lets an unauthenticated attacker with HTTP(S) access gain administrative control of the server. A companion path traversal, CVE-2024-27199, is less severe.

Rapid7 found both bugs and reported them in February. The flaw sits in how TeamCity handles a jsp query parameter on requests that end in a 404. A request such as /hax?jsp=/app/rest/users;.jsp reaches the REST API without logging in. One POST creates a new administrator; another mints an access token. Rapid7 published full details the same day, after JetBrains released the fix without the coordinated advisory Rapid7 expected.

Exploitation followed within days. CISA added CVE-2024-27198 to the KEV catalog on March 7 and marks it as used in ransomware campaigns. SecurityWeek reported LeakIX seeing rogue user creation on 1,400 instances, and GuidePoint suggesting the BianLian group may have used the bug for initial access. Trend Micro documented attacks dropping Jasmin ransomware, the XMRig miner, Cobalt Strike and the SparkRAT backdoor.

Who is affected#

Every TeamCity On-Premises version through 2023.11.3 is affected. The fix is 2023.11.4. JetBrains also shipped a security patch plugin for servers that could not upgrade, in one build for 2018.2 and newer and another for 2018.1 and older. TeamCity Cloud was patched by JetBrains, which says it saw no attacks there.

A server still on 2023.11.3 or older today has a second problem. CVE-2026-63077, an unauthenticated RCE that CISA added to KEV in 2026 and that has its own brief here, affects every TeamCity release before 2025.11.7 and 2026.1.3.

Do you really need to act?#

If your server was upgraded or plugin-patched in early March 2024, this bug is history. The risk is servers that were internet-facing and unpatched for even a few days after March 4, 2024. Exploitation was automated and large-scale, so presume such a server was touched. A CI server is a high-value target. It holds source code, VCS and cloud credentials, and signing keys, and it can push code to production, so a takeover can become a supply-chain incident.

What to do now#

  1. Check the version on every self-hosted server. It appears in the web UI footer and under Administration.
  2. Upgrade to a current release. 2023.11.4 closes this bug, but 2025.11.7, 2026.1.3 or later is needed for CVE-2026-63077.
  3. Keep the TeamCity UI off the internet, or put it behind a VPN or SSO proxy.
  4. Audit administrators, access tokens and plugins, and remove anything unexplained.
  5. If compromise is likely, rebuild the server and agents and rotate every secret TeamCity stores.

How to tell if you were hit#

Rapid7's guidance targets the logs directory (/opt/TeamCity/logs/ or C:\TeamCity\logs\). Run grep -E ';\S*\.jsp\?\S*jsp=' teamcity-javaLogging-*.log to find exploit-shaped URIs. Search teamcity-activities.log and teamcity-server.log for user_create, plugin_uploaded, plugin_deleted and delete_token_for_user events nobody can explain. Rapid7 notes that disabling a plugin leaves a permanent entry in config/disabled-plugins.xml, so check it for leftovers, and review the Audit page for new admins. On the host, Trend Micro saw TeamCity's java.exe spawning cmd.exe, certutil and PowerShell, a new local account named Default$, and files renamed with a .lsoc extension. Logs may have rotated away since 2024, so if a vulnerable server was exposed and you cannot prove otherwise, rebuild it.

Timeline#

  • — Rapid7 sends its technical analysis to JetBrains, which reproduces the bugs the same day.
  • — TeamCity 2023.11.4 is out (late Mar 3 in some time zones) with the patch plugin; JetBrains and Rapid7 publish details.
  • — CISA adds CVE-2024-27198 to KEV (due March 28, 2024).
  • — Trend Micro reports Jasmin ransomware, miners and backdoors deployed through the bug.

Vulnerability records

  • CVE-2024-27198 · KEV 2024-03-07 · In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. JetBrains — Additional critical security issues affecting TeamCity On-Premises (CVE-2024-27198 and CVE-2024-27199): update to 2023.11.4 now blog.jetbrains.com
  2. CVE record — CVE-2024-27198 cve.org
  3. NVD — CVE-2024-27198 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2024-27198 cisa.gov
  5. Rapid7 — CVE-2024-27198 and CVE-2024-27199: JetBrains TeamCity multiple authentication bypass vulnerabilities rapid7.com
  6. Trend Micro — TeamCity vulnerability exploits lead to Jasmin ransomware trendmicro.com

Coverage and analysis

  1. SecurityWeek — Recent TeamCity vulnerability exploited in ransomware attacks securityweek.com