{"id":"CVE-2024-27198","published":"2024-03-04T18:15:09Z","modified":"2026-06-17T07:19:24Z","title":"JetBrains TeamCity Authentication Bypass Vulnerability","vendor":"JetBrains","product":"TeamCity","tier":"core","eol":null,"description":{"text":"In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible","provenance":"source","from":"NVD"},"summary":{"text":"JetBrains TeamCity, the continuous integration and build server, contains an authentication bypass flaw in versions before 2023.11.4 that lives in its authentication handling. An attacker able to reach the TeamCity server over the network can use an alternate path to get past authentication and perform administrative actions, with no credentials or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:56:26Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99938,"percentile":0.99971,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2024-03-07","dueDate":"2024-03-28","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.jetbrains.com/help/teamcity/teamcity-2023-11-4-release-notes.html; https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-27198","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-03-05","exploitedFirstSeen":"2024-03-05","ransomware":true,"evidence":[{"url":"https://attackerkb.com/topics/K3wddwP3IJ/cve-2024-27198#exploited-in-the-wild_e28f53e6-cf6f-4b91-89be-6cb19dfd4315","date":"2024-03-05"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-05&host_type=src&vulnerability=cve-2024-27198","date":"2024-03-05"},{"url":"https://twitter.com/Shadowserver/status/1764960110659478012","date":"2024-03-05"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-06&host_type=src&vulnerability=cve-2024-27198","date":"2024-03-06"},{"url":"https://twitter.com/leak_ix/status/1765460190621581347","date":"2024-03-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-07&host_type=src&vulnerability=cve-2024-27198","date":"2024-03-07"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-03-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-08&host_type=src&vulnerability=cve-2024-27198","date":"2024-03-08"},{"url":"https://www.guidepointsecurity.com/blog/bianlian-gos-for-powershell-after-teamcity-exploitation/","date":"2024-03-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-09&host_type=src&vulnerability=cve-2024-27198","date":"2024-03-09"}],"evidenceTotal":793,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-288","name":"Authentication Bypass Using an Alternate Path or Channel"}],"references":[{"url":"https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","tags":["Vendor Advisory"]},{"url":"https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27198","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"exploitation_technique","evidence":[],"comment":"This authentication bypass vulnerability is exploited by an unauthenticated, remote adversary via an alternative path issue in the web component allowing attackers to perform admin actions and achieve remote code execution. To exploit this vulnerability, attackers need to generate an unauthenticated 404 HTTP response, pass the HTTP query string “?jsp=/app/rest/server”, and append “;.jsp” to the HTTP path parameter.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"This authentication bypass vulnerability is exploited by an unauthenticated, remote adversary via an alternative path issue in the web component allowing attackers to perform admin actions and achieve remote code execution. To exploit this vulnerability, attackers need to generate an unauthenticated 404 HTTP response, pass the HTTP query string “?jsp=/app/rest/server”, and append “;.jsp” to the HTTP path parameter.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-24437","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-24437","exploited":true,"exploitedSince":"2024-03-07","provenance":"source"},"exploits":[{"id":52411,"url":"https://www.exploit-db.com/exploits/52411","title":"JetBrains TeamCity 2023.11.4 - Authentication Bypass","type":"webapps","platform":"multiple","date":"2025-08-11","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-08-11"},"pocGithub":{"count":16,"skipped":4,"earliest":"2024-03-04","earliestUrl":"https://github.com/Chocapikk/CVE-2024-27198","repos":[{"name":"W01fh4cker/CVE-2024-27198-RCE","url":"https://github.com/W01fh4cker/CVE-2024-27198-RCE","stars":153,"created":"2024-03-06"},{"name":"yoryio/CVE-2024-27198","url":"https://github.com/yoryio/CVE-2024-27198","stars":37,"created":"2024-03-05"},{"name":"Stuub/RCity-CVE-2024-27198","url":"https://github.com/Stuub/RCity-CVE-2024-27198","stars":35,"created":"2024-04-22"},{"name":"Chocapikk/CVE-2024-27198","url":"https://github.com/Chocapikk/CVE-2024-27198","stars":34,"created":"2024-03-04"},{"name":"passwa11/CVE-2024-27198-RCE","url":"https://github.com/passwa11/CVE-2024-27198-RCE","stars":3,"created":"2024-03-08"}]},"metasploit":[{"name":"JetBrains TeamCity Unauthenticated Remote Code Execution","module":"exploit/multi/http/jetbrains_teamcity_rce_cve_2024_27198","type":"exploit","disclosureDate":"2024-03-04","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2024_27198.rb"}],"nuclei":[{"id":"CVE-2024-27198","name":"TeamCity < 2023.11.4 - Authentication Bypass","severity":"critical","path":"http/cves/2024/CVE-2024-27198.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27198.yaml"}],"first":{"date":"2024-03-04","source":"PoC-in-GitHub","url":"https://github.com/Chocapikk/CVE-2024-27198"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2024-03-04","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27198","provenance":"source"},{"date":"2024-03-04","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2024-03-04, Exploit-DB 2025-08-11","url":"https://github.com/Chocapikk/CVE-2024-27198","provenance":"source"},{"date":"2024-03-05","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://attackerkb.com/topics/K3wddwP3IJ/cve-2024-27198#exploited-in-the-wild_e28f53e6-cf6f-4b91-89be-6cb19dfd4315","provenance":"source"},{"date":"2024-03-07","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-03-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-24437","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":3},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 970 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 16 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}