CVE-2024-27199: JetBrains TeamCity Relative Path Traversal Vulnerability
JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.
Overview
JetBrains TeamCity On-Premises contains a relative path traversal flaw that allows an unauthenticated remote attacker to reach restricted administrative endpoints by crafting HTTP requests with traversal sequences in the URL. All versions prior to 2023.11.4 are affected. A successful attacker can perform a limited set of administrative actions and read some information without any credentials, bypassing the server's normal authentication checks. This vulnerability has been used in ransomware campaigns.
Vulnerability details
TeamCity's web component fails to properly validate relative path components in incoming HTTP requests. An attacker can supply traversal sequences in the URL that cause the server to resolve the request against administrative endpoints that sit outside the intended unauthenticated request surface. Because the routing logic processes the traversal before authentication checks are applied, the server treats the request as reaching a permitted path while actually serving a restricted one. This is the core behavior described by CWE-23 (Relative Path Traversal) and aligns with CWE-288, where an alternate path or channel bypasses authentication entirely.
An unauthenticated attacker with HTTP or HTTPS access to a TeamCity server sends a crafted request containing relative path traversal sequences targeting administrative endpoints. No credentials, user interaction, or prior foothold are required beyond network reachability. The attacker gains the ability to perform a limited set of administrative actions and read a limited amount of server information. While this is less severe than full administrative takeover, the flaw has been actively exploited in ransomware campaigns and in operations creating rogue administrative accounts on exposed instances.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review TeamCity server access logs for requests containing path traversal patterns (sequences such as /../ or URL-encoded equivalents like %2F..%2F) in the URL path, particularly those reaching /app/rest/ or other administrative API paths without a preceding authenticated session.
- Monitor TeamCity audit logs for unexpected administrative account creation or token generation events, especially those with no corresponding authenticated login event from the same source IP, which would indicate authentication was bypassed rather than satisfied.
- Alert on HTTP 200 responses to unauthenticated requests targeting TeamCity administrative REST API endpoints from external or untrusted source addresses, as authenticated administrative API calls should always follow a valid session establishment.
Remediation
Additional hardening
- Upgrade TeamCity On-Premises to version 2023.11.4 or later, which contains the fix for this vulnerability. Instances that cannot be upgraded immediately should apply the JetBrains security patch plugin available for versions through 2023.11.3.
- If immediate patching is not possible and the server is internet-facing, take the instance offline or restrict access to trusted network ranges until the patch or plugin is applied, as JetBrains explicitly recommends this step.
- Place TeamCity behind a network perimeter control or reverse proxy that restricts access to known CI/CD pipeline hosts and authorized administrator source addresses, reducing the attack surface for unauthenticated traversal attempts.
- Audit TeamCity for unexpected administrative accounts or API tokens created recently, and revoke any that cannot be attributed to a known administrative action, as active exploitation has included creation of rogue admin accounts.
Key dates
References
- https://www.jetbrains.com/privacy-security/issues-fixed/
- https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/
- https://nvd.nist.gov/vuln/detail/CVE-2024-27199
- https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive
- https://github.com/Stuub/RCity-CVE-2024-27198/blob/main/RCity.py
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27199
Frequently asked questions
Does CVE-2024-27199 affect my FedRAMP authorization?
If JetBrains TeamCity runs inside your authorization boundary, yes. CVE-2024-27199 appears on CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of May 4, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV in your boundary is a finding. An overdue one is a finding your assessor and sponsoring agency can already see. Your options now are to remediate it or formally document the mitigation and the delay.
How does Knox help me handle CVE-2024-27199?
Knox does not patch your software. Remediating JetBrains TeamCity is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, along with continuous compliance monitoring and audit-artifact coverage that support documentation of the fix for your next assessment. The remediation work is yours to carry out; maintaining your compliance posture while you do it is not something you have to manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on an ongoing basis. For a case like CVE-2024-27199, that means exposure surfaces during continuous monitoring rather than only when an assessor flags it at review time, giving your team earlier visibility into what needs to be addressed.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2024-27199's remediation deadline of May 4, 2026 has passed. What happens now?
An unremediated CVE-2024-27199 is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing it out now and documenting why the deadline passed is what keeps your authorization intact and the agency relationship on solid footing.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
