CISA adds JetBrains TeamCity bug to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-27198 +1 in the same advisory: …27199 | Authentication Bypass in JetBrains TeamCity CI/CD Server CVE-2024-27198 is an authentication bypass (CWE-288) in JetBrains TeamCity, JetBrains' self-hosted on-premises continuous integration/continuous delivery (CI/CD) server, that allows an unauthenticated attacker to circumvent login and perform administrative actions. It is triggered by sending specially crafted requests to the TeamCity web interface that dodge the authentication check, after which the attacker gains full administrator access. With admin access, an attacker can create administrative accounts, alter build configurations, plant code that runs on the server and its build agents, and reach source code, credentials, and secrets stored in the CI/CD environment, which ransomware operators have already used as an entry point. Any TeamCity deployment an attacker can reach over the network is affected, with internet-facing instances at the highest risk. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2024-03-07 with known ransomware use, and EPSS estimates a 99.9% probability of exploitation within 30 days. Do: Upgrade immediately to the patched TeamCity release per JetBrains' advisory (2023.11.4 or later fixes this vulnerability), or apply vendor mitigations or discontinue use per CISA guidance if patching is not possible. Audit instances for unexpected administrator accounts, modified build configurations, and other signs of compromise, since ransomware operators are known to be actively exploiting this bug. Restrict TeamCity's network exposure to trusted users and networks until the update is applied. | 9.8 group max | 100% | KEV ransomware |
| largetens of thousands of internet-exposed TeamCity servers (roughly 20,000–30,000 per public scans at disclosure) |
Full article377 words · extracted from securityaffairs.com · click to collapse
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a JetBrains TeamCity vulnerability to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the CVE-2024-27198 (CVSS Score 9.8) JetBrains TeamCity authentication bypass vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
This week Rapid7 researchers disclosed two new critical security vulnerabilities, tracked as CVE-2024-27198 (CVSS score: 9.8) and CVE-2024-27199 (CVSS score:7.3), in JetBrains TeamCity On-Premises.
An attacker can exploit the vulnerabilities to take control of affected systems.
Below are the descriptions for these vulnerabilities:
- CVE-2024-27198 is an authentication bypass vulnerability in the web component of TeamCity that arises from an alternative path issue (CWE-288) and has a CVSS base score of 9.8 (Critical).
- CVE-2024-27199 is an authentication bypass vulnerability in the web component of TeamCity that arises from a path traversal issue (CWE-22) and has a CVSS base score of 7.3 (High).
“The vulnerabilities may enable an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and gain administrative control of that TeamCity server.” reads the advisory published by JetBrains.
The flaws impact all TeamCity On-Premises versions through 2023.11.3, it was addressed with the release of version 2023.11.4.
The company also released a security patch plugin for those customers who are unable to patch their systems.
The two flaws were discovered by Stephen Fewer, Principal Security Researcher at Rapid7, were disclosed following Rapid7’s vulnerability disclosure policy.
Rapid7 published a detailed analysis of the two flaws here.
Describing the flaw CVE-2024-27198, the researchers pointed out that an unauthenticated attacker can use a specially crafted URL to bypass all authentication checks. A remote unauthenticated attacker can exploit this flaw to take complete control of a vulnerable TeamCity server.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this vulnerability by March 28, 2024.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – Hacking, Known Exploited Vulnerabilities catalog)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/160236/security/jetbrains-teamcity-bug-cisa-known-exploited-vulnerabilities-catalog.html