CVE-2024-27198 — JetBrains TeamCity Authentication Bypass

Key facts

CVE-2024-27198 is a Critical (9.8) vulnerability: JetBrains TeamCity Authentication Bypass. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-03-07), confirming active exploitation in the wild, and is linked to known ransomware campaigns.

Actively exploited — on the CISA KEV catalog

CVE-2024-27198 is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-03-07), confirming exploitation in the wild. It is linked to known ransomware campaigns. Federal remediation deadline: 2024-03-28. Prioritise patching and deploy the detection and prevention rules below.

CVE	CVE-2024-27198
Severity	Critical (9.8)
CISA KEV	Actively exploited (added 2024-03-07) · ransomware
Product	JetBrains TeamCity
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2024/CVE-2024-27198/

Details

CVE-2024-27198 (JetBrains TeamCity) is a Critical (9.8) vulnerability: JetBrains TeamCity Authentication Bypass. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

Attribute	Value
CVE ID	CVE-2024-27198
CVSS Score	9.8 (Critical)
Product	JetBrains TeamCity
Type	Authentication Bypass
CWE	CWE-288 (Authentication Bypass Using an Alternate Path)

Description

Critical authentication bypass vulnerability in JetBrains TeamCity that allows unauthenticated attackers to access admin REST API endpoints and create admin users/tokens. The vulnerability exploits URL path handling where appending ;.jsp to REST API paths bypasses authentication checks.

Affected Versions

• TeamCity < 2023.11.4

Verification Process

The PoC uses a multi-stage verification approach:

Step 1: TeamCity Detection (Passive)

[*] Query /login.html
[*] Detect TeamCity and extract version
[*] Check if version is in vulnerable range

Step 2: Active Authentication Bypass Testing

Method	Description	Detection
REST API Bypass	Access /app/rest/users;.jsp	Returns user data without auth
Admin Endpoint	Access /admin/admin.html;.jsp	Returns admin page content
User Enumeration	List users via /app/rest/users;.jsp	XML/JSON user data accessible
Token Access	Access /app/rest/users/id:1/tokens;.jsp	Token endpoint accessible

Verification Flow

┌─────────────────────────────────────────────────────────────┐
│                    TeamCity Detection                        │
│  GET /login.html → Check for "TeamCity"                     │
│  Extract version → Check if < 2023.11.4                     │
└─────────────────────────────────────────────────────────────┘
                              ↓
┌─────────────────────────────────────────────────────────────┐
│             Active Authentication Bypass Testing             │
│                                                              │
│  1. REST API Bypass                                          │
│     └─ GET /app/rest/users;.jsp                             │
│     └─ If user data returned → CONFIRMED VULNERABLE         │
│                                                              │
│  2. Admin Endpoint Access                                    │
│     └─ GET /admin/admin.html;.jsp                           │
│     └─ If admin content returned → CONFIRMED VULNERABLE     │
│                                                              │
│  3. User Enumeration                                         │
│     └─ GET /app/rest/users;.jsp (Accept: application/json) │
│     └─ If JSON/XML user list → CONFIRMED VULNERABLE         │
│                                                              │
│  4. Token Endpoint Access                                    │
│     └─ GET /app/rest/users/id:1/tokens;.jsp                 │
│     └─ If token data accessible → CONFIRMED VULNERABLE      │
└─────────────────────────────────────────────────────────────┘

Usage

# Full vulnerability check (version + active testing)
python3 poc.py -t https://teamcity.target.com -c

# Version-only check (passive, no bypass attempts)
python3 poc.py -t https://teamcity.target.com -c --version-only

Expected Output (Vulnerable)

============================================================
CVE-2024-27198 - TeamCity Authentication Bypass
CVSS: 9.8 (Critical) | Affects: TeamCity < 2023.11.4
============================================================

[*] Target: https://teamcity.target.com
[*] Step 1: Detecting TeamCity...
[+] TeamCity detected
[*] Detected: TeamCity 2023.11.2
[!] Version 2023.11.2 is in vulnerable range
[*] Step 2: Active authentication bypass testing...
[*] Testing REST API authentication bypass...
[!] VULNERABLE - Accessed protected endpoint

============================================================
RESULTS
============================================================
[!] STATUS: VULNERABLE
[!] Method: rest_api_bypass
[!] Details: CONFIRMED: Accessed protected endpoint without auth: /app/rest/users;.jsp
[*] Version: TeamCity 2023.11.2

Mitigation

1. Upgrade immediately to TeamCity 2023.11.4 or later

2. Apply temporary mitigations:

3. Block access to paths containing ; character

4. Use WAF rules to block malicious patterns

5. Monitor for exploitation:

6. Check for requests to /app/rest/*;.jsp
7. Review newly created admin users/tokens

8. Audit authentication logs

9. Network segmentation:

10. Restrict TeamCity access to internal networks
11. Use VPN for external access

References

• JetBrains Security Bulletin
• NVD Entry
• Rapid7 Analysis

Detection and prevention

Ready-to-deploy defensive rules for CVE-2024-27198, for authorized testing and blue-team detection engineering:

• Snort IDS signature — prevention/snort.rules
• YARA detection rule — prevention/yara.yar
• Nginx mitigation — prevention/nginx.conf
• Apache HTTPD mitigation — prevention/httpd.conf
• Detection-only PoC — poc.py
• Rule notes — prevention/README.md

References: NVD — CVE-2024-27198 · full write-up on the searchable site

Detection & prevention rules

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2024-27198 - JetBrains TeamCity Authentication Bypass Snort Rules
# Severity: Critical (CVSS 9.8)

# Detect /hax authentication bypass
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-27198 TeamCity Auth Bypass /hax Endpoint";
    flow:to_server,established;
    content:"/hax"; http_uri;
    classtype:web-application-attack;
    sid:2024271981;
    rev:1;
    metadata:cve CVE-2024-27198, severity critical;
)

# Detect jsp parameter bypass
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-27198 TeamCity Auth Bypass jsp Parameter";
    flow:to_server,established;
    content:"jsp="; http_uri;
    content:"/app/rest/"; http_uri;
    classtype:web-application-attack;
    sid:2024271982;
    rev:1;
    metadata:cve CVE-2024-27198, severity critical;
)

# Detect .jsp suffix bypass
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-27198 TeamCity Auth Bypass .jsp Suffix";
    flow:to_server,established;
    pcre:"/;\.jsp/Ui";
    classtype:web-application-attack;
    sid:2024271983;
    rev:1;
    metadata:cve CVE-2024-27198, severity critical;
)

# Detect unauthenticated user creation
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-27198 TeamCity User Creation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/app/rest/users"; http_uri;
    classtype:web-application-attack;
    sid:2024271984;
    rev:1;
    metadata:cve CVE-2024-27198, severity critical;
)

# Detect admin role assignment
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-27198 TeamCity Admin Role Assignment";
    flow:to_server,established;
    content:"/app/rest/users"; http_uri;
    content:"SYSTEM_ADMIN"; nocase;
    classtype:web-application-attack;
    sid:2024271985;
    rev:1;
    metadata:cve CVE-2024-27198, severity critical;
)

# Detect token generation attempt
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-27198 TeamCity Token Generation";
    flow:to_server,established;
    content:"/app/rest/users/"; http_uri;
    content:"/tokens"; http_uri;
    classtype:web-application-attack;
    sid:2024271986;
    rev:1;
    metadata:cve CVE-2024-27198, severity critical;
)

# Detect debug endpoint access
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-27198 TeamCity Debug Endpoint Access";
    flow:to_server,established;
    content:"/app/rest/debug/"; http_uri;
    classtype:web-application-attack;
    sid:2024271987;
    rev:1;
    metadata:cve CVE-2024-27198, severity high;
)

# Detect build configuration creation (potential RCE)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-27198 TeamCity Build Config Creation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/app/rest/"; http_uri;
    content:"buildTypes"; http_uri;
    classtype:web-application-attack;
    sid:2024271988;
    rev:1;
    metadata:cve CVE-2024-27198, severity critical;
)

# Detect reconnaissance of TeamCity version
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-27198 TeamCity Version Reconnaissance";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/app/rest/server"; http_uri;
    detection_filter:track by_src, count 5, seconds 60;
    classtype:attempted-recon;
    sid:2024271989;
    rev:1;
    metadata:cve CVE-2024-27198, severity medium;
)

:material-file-download: prevention/snort.rules

/*
 * CVE-2024-27198 - JetBrains TeamCity Authentication Bypass YARA Rules
 * Severity: Critical (CVSS 9.8)
 */

rule CVE_2024_27198_Auth_Bypass_Request {
    meta:
        description = "Detects CVE-2024-27198 TeamCity authentication bypass attempts"
        author = "Security Research"
        date = "2024-03-04"
        cve = "CVE-2024-27198"
        severity = "critical"

    strings:
        // Primary bypass patterns
        $bypass1 = "/hax?" ascii wide
        $bypass2 = "jsp=/app/rest/" ascii wide
        $bypass3 = ";.jsp" ascii wide

        // Target endpoints
        $api1 = "/app/rest/users" ascii wide
        $api2 = "/app/rest/server" ascii wide
        $api3 = "/app/rest/debug" ascii wide
        $api4 = "/app/rest/buildTypes" ascii wide

        // HTTP context
        $http1 = "GET " ascii wide
        $http2 = "POST " ascii wide
        $http3 = "PUT " ascii wide

    condition:
        any of ($bypass*) and any of ($api*)
}

rule CVE_2024_27198_User_Creation {
    meta:
        description = "Detects TeamCity malicious user creation payload"
        author = "Security Research"
        date = "2024-03-04"
        cve = "CVE-2024-27198"
        severity = "critical"

    strings:
        // User creation JSON structure
        $json1 = "\"username\"" ascii wide
        $json2 = "\"password\"" ascii wide
        $json3 = "\"roles\"" ascii wide
        $json4 = "\"roleId\"" ascii wide

        // Admin role indicators
        $admin1 = "SYSTEM_ADMIN" ascii wide
        $admin2 = "PROJECT_ADMIN" ascii wide
        $admin3 = "\"scope\":\"g\"" ascii wide

        // API endpoint
        $endpoint = "/app/rest/users" ascii wide

    condition:
        $endpoint and (2 of ($json*)) and any of ($admin*)
}

rule CVE_2024_27198_Token_Generation {
    meta:
        description = "Detects TeamCity API token generation attempts"
        author = "Security Research"
        date = "2024-03-04"
        cve = "CVE-2024-27198"
        severity = "critical"

    strings:
        // Token endpoint patterns
        $token1 = "/tokens" ascii wide
        $token2 = "/app/rest/users/" ascii wide
        $token3 = "\"name\":" ascii wide
        $token4 = "\"value\":" ascii wide

        // Bypass context
        $bypass1 = "/hax" ascii wide
        $bypass2 = "jsp=" ascii wide

    condition:
        ($token1 and $token2) or (any of ($bypass*) and any of ($token*))
}

rule CVE_2024_27198_RCE_BuildConfig {
    meta:
        description = "Detects TeamCity malicious build configuration for RCE"
        author = "Security Research"
        date = "2024-03-04"
        cve = "CVE-2024-27198"
        severity = "critical"

    strings:
        // Build step configuration
        $step1 = "simpleRunner" ascii wide
        $step2 = "command.executable" ascii wide
        $step3 = "script.content" ascii wide
        $step4 = "teamcity.step" ascii wide

        // Malicious commands
        $cmd1 = "cmd.exe" ascii wide
        $cmd2 = "powershell" ascii wide nocase
        $cmd3 = "/bin/sh" ascii wide
        $cmd4 = "/bin/bash" ascii wide
        $cmd5 = "wget " ascii wide
        $cmd6 = "curl " ascii wide

        // Build config context
        $ctx1 = "buildTypes" ascii wide
        $ctx2 = "buildSteps" ascii wide

    condition:
        any of ($ctx*) and any of ($step*) and any of ($cmd*)
}

rule CVE_2024_27198_Exploit_Tool {
    meta:
        description = "Detects TeamCity exploitation tools"
        author = "Security Research"
        date = "2024-03-04"
        cve = "CVE-2024-27198"
        severity = "critical"

    strings:
        // Common exploit tool indicators
        $tool1 = "CVE-2024-27198" ascii wide
        $tool2 = "TeamCity" ascii wide nocase
        $tool3 = "auth bypass" ascii wide nocase
        $tool4 = "create_admin" ascii wide nocase

        // Python exploit patterns
        $py1 = "requests.post" ascii wide
        $py2 = "requests.get" ascii wide
        $py3 = "/app/rest/users" ascii wide

        // Common exploit flow
        $flow1 = "SYSTEM_ADMIN" ascii wide
        $flow2 = "tokens" ascii wide

    condition:
        ($tool1 or $tool2) and (any of ($py*) or (any of ($flow*)))
}

rule CVE_2024_27198_Network_IOC {
    meta:
        description = "Network indicators for CVE-2024-27198 exploitation"
        author = "Security Research"
        date = "2024-03-04"
        cve = "CVE-2024-27198"
        severity = "high"

    strings:
        // HTTP request patterns
        $http1 = "GET /hax?jsp=" ascii wide
        $http2 = "POST /hax?jsp=/app/rest/users" ascii wide
        $http3 = /GET [^\r\n]*;\.jsp/ ascii

        // Response indicating success
        $resp1 = "\"username\":" ascii wide
        $resp2 = "\"id\":" ascii wide
        $resp3 = "201 Created" ascii wide

        // TeamCity specific
        $tc1 = "TeamCity" ascii wide nocase
        $tc2 = "JetBrains" ascii wide nocase

    condition:
        any of ($http*) and (any of ($resp*) or any of ($tc*))
}

:material-file-download: prevention/yara.yar

# CVE-2024-27198 - JetBrains TeamCity Authentication Bypass Prevention for Nginx

# Block authentication bypass patterns
location / {
    # Block the primary bypass vector
    if ($args ~* "jsp=") {
        return 403;
    }

    # Block alternative bypass patterns
    if ($request_uri ~* ";\.jsp") {
        return 403;
    }

    # Block /hax endpoint (known bypass)
    if ($request_uri ~* "^/hax") {
        return 403;
    }

    # Log suspicious patterns
    if ($request_uri ~* "(\.jsp|/app/rest/)") {
        access_log /var/log/nginx/teamcity-suspicious.log;
    }
}

# Block direct API access without authentication
location /app/rest/ {
    # Only allow from authenticated sessions or trusted IPs
    # This should be behind your auth proxy

    # Block user creation endpoint
    location /app/rest/users {
        # Strict access control
        allow 127.0.0.1;
        allow 10.0.0.0/8;
        deny all;

        access_log /var/log/nginx/teamcity-api.log;
    }

    # Block debug endpoints
    location /app/rest/debug/ {
        return 403;
    }

    # Block token generation
    location ~* /app/rest/users/.*/tokens {
        allow 127.0.0.1;
        deny all;
    }
}

# Block common bypass patterns
location ~* ^/hax {
    access_log /var/log/nginx/cve-2024-27198-attempts.log;
    return 403;
}

location ~* \.jsp$ {
    # Block JSP files from URL parameters
    if ($args ~* "jsp=") {
        return 403;
    }
}

# Additional security for admin endpoints
location /admin/ {
    # Require authentication (implement via auth_request or similar)
    # auth_request /auth;

    allow 127.0.0.1;
    allow 10.0.0.0/8;
    deny all;
}

# Security headers
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header X-XSS-Protection "1; mode=block" always;

# Rate limiting for API endpoints
limit_req_zone $binary_remote_addr zone=teamcity_api:10m rate=30r/m;

location /app/rest/ {
    limit_req zone=teamcity_api burst=10 nodelay;
}

:material-file-download: prevention/nginx.conf

# CVE-2024-27198 - JetBrains TeamCity Authentication Bypass Prevention for Apache HTTPD

# Enable required modules
# LoadModule rewrite_module modules/mod_rewrite.so
# LoadModule security2_module modules/mod_security2.so

# Block bypass endpoint
<LocationMatch "^/hax">
    Require all denied
    CustomLog /var/log/httpd/cve-2024-27198-blocked.log combined
</LocationMatch>

# Protect REST API endpoints
<LocationMatch "^/app/rest/">
    # Require authentication or trusted IP
    <RequireAny>
        Require ip 127.0.0.1
        Require ip 10.0.0.0/8
        Require ip 192.168.0.0/16
    </RequireAny>
</LocationMatch>

# Block user creation API
<LocationMatch "^/app/rest/users">
    Require ip 127.0.0.1
    CustomLog /var/log/httpd/teamcity-user-api.log combined
</LocationMatch>

# Block debug endpoints
<LocationMatch "^/app/rest/debug">
    Require all denied
</LocationMatch>

# ModSecurity Rules for CVE-2024-27198
<IfModule mod_security2.c>
    # Block /hax bypass pattern
    SecRule REQUEST_URI "@beginsWith /hax" \
        "id:2024271981,phase:1,deny,status:403,\
        msg:'CVE-2024-27198 TeamCity Auth Bypass /hax Attempt',\
        logdata:'%{REQUEST_URI}',severity:CRITICAL"

    # Block jsp parameter bypass
    SecRule ARGS:jsp "@rx ^/" \
        "id:2024271982,phase:1,deny,status:403,\
        msg:'CVE-2024-27198 TeamCity Auth Bypass jsp Parameter',\
        logdata:'jsp=%{ARGS.jsp}',severity:CRITICAL"

    # Block .jsp suffix bypass
    SecRule REQUEST_URI "@rx ;\.jsp" \
        "id:2024271983,phase:1,deny,status:403,\
        msg:'CVE-2024-27198 TeamCity Auth Bypass .jsp Suffix',\
        severity:CRITICAL"

    # Block unauthenticated user creation
    SecRule REQUEST_URI "@beginsWith /app/rest/users" \
        "id:2024271984,phase:1,chain,deny,status:403,\
        msg:'CVE-2024-27198 Unauthenticated User Creation Attempt'"
        SecRule REQUEST_METHOD "@streq POST" ""
        SecRule &REQUEST_HEADERS:Authorization "@eq 0" ""

    # Block token generation attempts
    SecRule REQUEST_URI "@rx /app/rest/users/[^/]+/tokens" \
        "id:2024271985,phase:1,deny,status:403,\
        msg:'CVE-2024-27198 Token Generation Attempt',\
        severity:CRITICAL"

    # Block requests with SYSTEM_ADMIN role creation
    SecRule REQUEST_BODY "@rx SYSTEM_ADMIN" \
        "id:2024271986,phase:2,chain,deny,status:403,\
        msg:'CVE-2024-27198 Admin Role Assignment Attempt'"
        SecRule REQUEST_URI "@contains /users" ""

    # Block debug process access
    SecRule REQUEST_URI "@contains /debug/processes" \
        "id:2024271987,phase:1,deny,status:403,\
        msg:'CVE-2024-27198 Debug Process Access',\
        severity:HIGH"
</IfModule>

# Rewrite rules to block bypasses
RewriteEngine On
RewriteCond %{QUERY_STRING} jsp= [NC]
RewriteRule ^ - [F,L]

RewriteCond %{REQUEST_URI} ;\.jsp [NC]
RewriteRule ^ - [F,L]

# Logging
CustomLog /var/log/httpd/teamcity-access.log combined

:material-file-download: prevention/httpd.conf

Frequently asked questions

What is CVE-2024-27198?

CVE-2024-27198 is a Critical (9.8) vulnerability: JetBrains TeamCity Authentication Bypass. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-03-07), confirming active exploitation in the wild, and is linked to known ransomware campaigns.

How do I detect CVE-2024-27198?

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2024-27198?

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

Is CVE-2024-27198 actively exploited?

Yes. CVE-2024-27198 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2024-03-07, which means it has been exploited in the wild. CISA also links it to known ransomware campaigns. CISA set a federal remediation deadline of 2024-03-28. Prioritise patching and deploy the detection and prevention rules above.

---

For authorized security testing and research only. See the full source and NVD record.