Skip to content

PRP: Request CVE-2024-27198 TeamCity Unauthenticated Remote Code Execution #404

@frkngksl

Description

@frkngksl

Hi there,

I would like to implement a detector for the following vulnerability if it is in the scope. CVE-2024-27198 JetBrains TeamCity Unauthenticated RCE

Reference:
https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/
https://blog.jetbrains.com/teamcity/2024/02/critical-security-issue-affecting-teamcity-on-premises-cve-2024-23917/
https://nvd.nist.gov/vuln/detail/CVE-2024-27198

Description:
TeamCity exposes a web server over HTTP port 8111 by default (and can optionally be configured to run over HTTPS). An attacker can craft a URL such that all authentication checks are avoided, allowing endpoints that are intended to be authenticated to be accessed directly by an unauthenticated attacker. A remote unauthenticated attacker can leverage this to take complete control of a vulnerable TeamCity server.

Versions:
Below JetBrains TeamCity Version 2023.11.4

Metadata

Metadata

Assignees

Labels

Contributor mainThe main issue a contributor is working on (top of the contribution queue).PRP:Accepted

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions