CVE-2024-24938: JetBrains TeamCity Path Traversal Flaw

CVE-2024-24938 Overview

CVE-2024-24938 is a limited directory traversal vulnerability affecting JetBrains TeamCity continuous integration server. The flaw resides in the Kotlin Domain Specific Language (DSL) documentation component and allows unauthenticated attackers to access files outside the intended directory scope over the network. JetBrains addressed the issue in TeamCity version 2023.11.2. The vulnerability maps to [CWE-22] Path Traversal and [CWE-23] Relative Path Traversal. Exploitation requires no privileges or user interaction, though impact is limited to confidentiality of a constrained set of resources.

Critical Impact
Unauthenticated network-based access to files via path traversal in the Kotlin DSL documentation endpoint, leading to limited information disclosure.

Affected Products

JetBrains TeamCity versions prior to 2023.11.2
Kotlin DSL documentation component in TeamCity
On-premises TeamCity server deployments exposed to untrusted networks

Discovery Timeline

2024-02-06 - CVE-2024-24938 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24938

Vulnerability Analysis

The vulnerability is a limited directory traversal in the Kotlin DSL documentation feature of JetBrains TeamCity. An unauthenticated remote attacker can craft HTTP requests that manipulate path components to read resources outside the documentation directory. The scope of accessible content is constrained, which limits the vulnerability to information disclosure rather than code execution or data modification. Integrity and availability are not affected according to the published impact metrics. The flaw is exploitable over the network with low attack complexity and does not require user interaction.

Root Cause

The root cause is improper validation and sanitization of file path input within the Kotlin DSL documentation request handler. The affected code accepts path segments that include traversal sequences such as ../ without canonicalizing or confining the resulting path to the intended base directory. This maps to [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory) and [CWE-23] (Relative Path Traversal).

Attack Vector

An attacker sends a crafted HTTP request to the Kotlin DSL documentation endpoint of a vulnerable TeamCity instance. The request contains encoded or raw path traversal sequences designed to resolve to files outside the documentation root. No authentication is required. Successful exploitation returns the contents of accessible files to the attacker. Verified exploit code and proof-of-concept artifacts are not publicly listed in the referenced sources at the time of writing.

No verified exploit code is available in the referenced sources. Refer to the JetBrains Security Issues Fixed advisory for vendor-supplied technical details.

Detection Methods for CVE-2024-24938

Indicators of Compromise

HTTP requests to Kotlin DSL documentation URIs containing ../, ..%2f, or other encoded traversal sequences
Unexpected 200 OK responses to documentation requests referencing non-documentation file paths
TeamCity access logs showing anomalous path components from unauthenticated clients

Detection Strategies

Inspect TeamCity web server access logs for request URIs containing traversal patterns targeting Kotlin DSL documentation paths
Deploy web application firewall (WAF) rules that identify and block path traversal payloads in requests to TeamCity endpoints
Correlate repeated requests from a single source IP against documentation paths with abnormal response sizes

Monitoring Recommendations

Enable verbose HTTP request logging on TeamCity reverse proxies and ingest logs into a centralized SIEM
Alert on unauthenticated access attempts to administrative or documentation endpoints from external networks
Review network perimeter policies to confirm that TeamCity administrative interfaces are not exposed to untrusted networks

How to Mitigate CVE-2024-24938

Immediate Actions Required

Upgrade JetBrains TeamCity to version 2023.11.2 or later as the primary remediation
Restrict network access to the TeamCity server so only trusted administrative networks can reach the web interface
Audit TeamCity access logs for prior exploitation attempts targeting the Kotlin DSL documentation endpoint

Patch Information

JetBrains fixed the vulnerability in TeamCity 2023.11.2. Administrators should apply the vendor-supplied update by following the upgrade procedure documented in the JetBrains Security Issues Fixed advisory. Verify the TeamCity version after upgrade using the server administration interface.

Workarounds

Place TeamCity behind a reverse proxy or WAF configured to normalize URL paths and reject requests containing traversal sequences
Limit inbound access to the TeamCity web interface using firewall rules or VPN-only access until the patch is applied
Disable or restrict public exposure of the documentation endpoint where supported by deployment configuration

bash

# Example NGINX reverse proxy snippet to reject path traversal attempts
location / {
    if ($request_uri ~* "(\.\./|\.\.%2f|%2e%2e/)") {
        return 403;
    }
    proxy_pass http://teamcity_backend;
}