CVE-2024-23917: JetBrains TeamCity Auth Bypass Vulnerability

CVE-2024-23917 Overview

CVE-2024-23917 is an authentication bypass vulnerability in JetBrains TeamCity versions before 2023.11.3. The flaw allows unauthenticated remote attackers to bypass authentication checks and achieve remote code execution (RCE) on affected TeamCity servers. The vulnerability maps to [CWE-288] (Authentication Bypass Using an Alternate Path) and [CWE-306] (Missing Authentication for Critical Function).

TeamCity is a continuous integration and build management server widely deployed in software development pipelines. Successful exploitation grants attackers full control over the build server, source code, build artifacts, and downstream deployment targets.

Critical Impact

Unauthenticated network attackers can bypass authentication on TeamCity servers and execute arbitrary code, compromising CI/CD pipelines and software supply chains.

Affected Products

• JetBrains TeamCity versions prior to 2023.11.3
• On-premises TeamCity server installations exposed to network access
• CI/CD environments and build agents managed by vulnerable TeamCity instances

Discovery Timeline

• 2024-02-06 - CVE-2024-23917 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-23917

Vulnerability Analysis

The vulnerability resides in the authentication handling logic of JetBrains TeamCity server. An attacker can craft HTTP requests that bypass authentication checks and reach privileged administrative endpoints. Once authentication is bypassed, the attacker can invoke functionality reserved for authenticated administrators, including endpoints that lead to arbitrary code execution.

The attack requires no user interaction and no prior credentials. Network reachability to the TeamCity web interface is the only prerequisite. The EPSS probability of 72.925% and percentile of 98.807 indicate active interest and high likelihood of exploitation attempts in the wild.

Root Cause

The root cause is missing authentication enforcement on critical request paths ([CWE-306]) combined with an alternate path that bypasses the standard authentication filter ([CWE-288]). Request routing or filter ordering permits specific URL patterns to reach protected handlers without traversing the authentication layer.

Attack Vector

The attack vector is network-based. An attacker sends specially crafted HTTP requests directly to the TeamCity web server. The crafted requests reach administrative API endpoints that should require authentication. From there, the attacker can create administrative users, modify build configurations, retrieve secrets, or execute commands on the server through legitimate but privileged TeamCity functionality.

No verified public proof-of-concept code is referenced in the NVD entry. Refer to the JetBrains Security Issues Fixed advisory for vendor-provided technical context.

Detection Methods for CVE-2024-23917

Indicators of Compromise

• Unexpected administrative user accounts created in TeamCity, particularly with names not matching naming conventions
• New or modified build configurations executing shell commands, downloading external payloads, or writing to unusual paths
• Outbound network connections from the TeamCity server or build agents to unfamiliar IP addresses
• Modified or newly added SSH keys, API tokens, or personal access tokens in TeamCity user profiles

Detection Strategies

• Review TeamCity server access logs for anomalous requests to /app/rest/ and authentication-related endpoints from unauthenticated sessions
• Audit the TeamCity audit log for administrative actions performed by accounts created shortly before the activity
• Hunt for process executions spawned by the TeamCity service account that deviate from normal build behavior
• Correlate web server access logs with user creation and configuration change events in TeamCity

Monitoring Recommendations

• Enable verbose authentication and audit logging on TeamCity and forward logs to a central SIEM
• Monitor for child processes of the TeamCity Java process, especially shells, scripting interpreters, and download utilities
• Alert on creation of new administrator-level users or changes to global server settings
• Track egress traffic from build servers and apply network segmentation to restrict outbound access

How to Mitigate CVE-2024-23917

Immediate Actions Required

• Upgrade JetBrains TeamCity to version 2023.11.3 or later without delay
• Restrict network access to the TeamCity web interface to trusted management networks or VPN users
• Audit all TeamCity user accounts, API tokens, and SSH keys, and revoke any that are unrecognized
• Rotate secrets, credentials, and signing keys stored or referenced by TeamCity if compromise is suspected

Patch Information

JetBrains addressed the vulnerability in TeamCity 2023.11.3. Administrators running on-premises TeamCity should upgrade through the official upgrade path. JetBrains Cloud customers received the fix server-side. Patch details and a list of fixed security issues are available at the JetBrains Security Issues Fixed page.

Workarounds

• If immediate patching is not feasible, block external access to the TeamCity server at the network perimeter
• Place TeamCity behind an authenticating reverse proxy that enforces an additional authentication layer
• Disable or isolate the TeamCity instance until the upgrade can be completed

# Example: restrict TeamCity port 8111 to a trusted management subnet using iptables
iptables -A INPUT -p tcp --dport 8111 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8111 -j DROP