Skip to content

CVE-2024-23917 — JetBrains TeamCity Authentication Bypass

Key facts

CVE-2024-23917 is a Critical vulnerability: JetBrains TeamCity Authentication Bypass. This entry ships a detection-only PoC.
CVE CVE-2024-23917
Severity Critical
Detection / prevention —
PoC poc.py
Source 2024/CVE-2024-23917/

Details

Overview

A critical authentication bypass vulnerability in JetBrains TeamCity before version 2023.11.3 allows an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and gain administrative control of the server.

Vulnerability Details

  • CVE ID: CVE-2024-23917
  • CVSS Score: 9.8 (Critical)
  • CWE: CWE-306 (Missing Authentication for Critical Function)
  • Vendor: JetBrains

Affected Products

  • JetBrains TeamCity versions before 2023.11.3
  • Both on-premises and cloud instances

Technical Details

This vulnerability allows an unauthenticated attacker to bypass authentication mechanisms and obtain administrative access to the TeamCity server. With administrative access, an attacker can:

  1. Execute arbitrary code on the TeamCity server
  2. Access all build configurations and artifacts
  3. Retrieve stored credentials and secrets
  4. Modify build pipelines to inject malicious code
  5. Pivot to connected systems and repositories

Attack Vector

  1. Attacker identifies TeamCity instance (usually on port 8111)
  2. Attacker sends specially crafted requests to REST API endpoints
  3. Authentication is bypassed due to improper validation
  4. Attacker gains administrative access to TeamCity
  5. Attacker can create admin users, access secrets, or execute code

Exploitation Requirements

  • Network access to TeamCity server (HTTP/HTTPS)
  • No authentication required
  • No user interaction required

Proof of Concept

Usage

# Basic vulnerability check
python3 poc.py -t https://teamcity.target.com -c

# Version detection only (passive)
python3 poc.py -t https://teamcity.target.com -c --version-only

# Verbose output
python3 poc.py -t https://teamcity.target.com -c -v

Verification Methods

  1. Auth Bypass Endpoint Test: Tests REST API endpoints for unauthenticated access
  2. Path Manipulation Test: Tests path-based authentication bypass techniques
  3. Token Manipulation Test: Tests header and token-based bypasses
  4. Admin Access Test: Tests direct administrative panel access

Indicators of Compromise

  • Unexpected administrative users created
  • Unusual API access patterns in logs
  • Modified build configurations
  • Unauthorized access to artifacts or secrets
  • New agent registrations from unknown sources

Mitigation

  1. Immediate Action: Upgrade to TeamCity 2023.11.3 or later
  2. Temporary Mitigation: Restrict network access to TeamCity server
  3. Review: Audit administrative users and recent changes
  4. Credentials: Rotate any secrets stored in TeamCity
  5. Monitoring: Enable and review access logs

Timeline

  • 2024-01-19: Vulnerability disclosed to JetBrains
  • 2024-02-06: JetBrains releases patched version 2023.11.3
  • 2024-02-06: Public disclosure

References

Disclaimer

This proof of concept is provided for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal.

Frequently asked questions

What is CVE-2024-23917?

CVE-2024-23917 is a Critical vulnerability: JetBrains TeamCity Authentication Bypass. This entry ships a detection-only PoC.

How do I detect CVE-2024-23917?

Run the detection-only PoC included with this entry against your Docker test lab to confirm whether a target is affected; pair it with your own IDS logging.

How do I block or mitigate CVE-2024-23917?

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

For authorized security testing and research only. See the full source and NVD record.