CVE-2024-24942 Overview
CVE-2024-24942 is a path traversal vulnerability in JetBrains TeamCity affecting versions prior to 2023.11.3. The flaw allows unauthenticated attackers to read data contained within JAR archives on the TeamCity server. The vulnerability is exploitable over the network without user interaction or authentication, exposing information stored in packaged Java resources.
Critical Impact
Remote unauthenticated attackers can traverse file paths to disclose data within JAR archives hosted by the TeamCity server, potentially exposing configuration files, class metadata, or embedded resources [CWE-22, CWE-23].
Affected Products
- JetBrains TeamCity versions before 2023.11.3
- On-premises TeamCity server deployments
- Any CI/CD pipeline depending on affected TeamCity instances
Discovery Timeline
- 2024-02-06 - CVE-2024-24942 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-24942
Vulnerability Analysis
The vulnerability resides in how TeamCity resolves resource paths inside JAR archive files. An attacker can craft a request containing traversal sequences that escape the intended resource directory and read arbitrary entries within JAR files. Because the endpoint does not require authentication, the attack surface extends to any network-reachable TeamCity server.
The issue is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory and [CWE-23] Relative Path Traversal. Exploitation impacts confidentiality only, with no direct effect on integrity or availability. Disclosed JAR contents may include application classes, resource bundles, license files, or embedded credentials placed in Java packages.
With an EPSS probability of 31.977% placing it in the 98th percentile, this vulnerability sees meaningful attacker interest despite its medium severity rating. TeamCity servers are frequent targets because they hold source code, build artifacts, and pipeline secrets.
Root Cause
The root cause is insufficient sanitization of user-supplied path components used when reading entries from JAR archives. The resource lookup logic accepts relative traversal tokens without normalizing or validating them against a permitted base path. This allows a crafted request to reference archive entries outside the expected resource namespace.
Attack Vector
Exploitation occurs over the network against exposed TeamCity HTTP endpoints. No credentials or user interaction are required. An attacker sends an HTTP request with traversal sequences in the path parameter used for JAR resource resolution, and the server returns the referenced JAR entry contents in the response.
No public proof-of-concept exploit code has been published in the referenced advisory. Refer to the JetBrains Security Issues Fixed advisory for vendor guidance.
Detection Methods for CVE-2024-24942
Indicators of Compromise
- HTTP requests to TeamCity containing path traversal sequences such as ../ or URL-encoded variants %2e%2e%2f in resource paths
- Anomalous responses returning JAR entry contents to unauthenticated clients
- Access log entries referencing .jar! internal paths from external IP addresses
- Repeated resource-fetch requests targeting /res/, /img/, or plugin resource endpoints
Detection Strategies
- Inspect TeamCity access logs (teamcity-javaLogging and teamcity-rest) for traversal patterns and non-standard resource requests
- Enable web application firewall rules that block path traversal payloads targeting /app/ and static resource paths
- Baseline expected static-resource request patterns and alert on deviations from unauthenticated sources
Monitoring Recommendations
- Forward TeamCity server logs to a centralized SIEM for correlation with network telemetry
- Monitor outbound data volume from TeamCity servers to identify bulk resource scraping
- Track TeamCity version inventory to confirm patch coverage across CI/CD infrastructure
How to Mitigate CVE-2024-24942
Immediate Actions Required
- Upgrade all TeamCity server instances to version 2023.11.3 or later
- Audit exposed TeamCity servers and restrict internet-facing access where possible
- Review recent access logs for evidence of exploitation attempts prior to patching
- Rotate any credentials or secrets that may have been embedded in accessible JAR resources
Patch Information
JetBrains addressed this vulnerability in TeamCity 2023.11.3. Administrators should follow the upgrade instructions in the JetBrains Security Issues Fixed advisory. On-premises deployments require manual upgrade; verify the running version through the TeamCity administration console after patching.
Workarounds
- Place TeamCity behind an authenticating reverse proxy that enforces path normalization before requests reach the server
- Deploy WAF rules that reject requests containing encoded or literal traversal sequences targeting resource endpoints
- Restrict TeamCity server exposure to trusted networks or VPN-only access until patching completes
# Example WAF rule pattern to block path traversal in TeamCity resource requests
SecRule REQUEST_URI "@rx (\.\./|%2e%2e%2f|%2e%2e/|\.\.%2f)" \
"id:100241,phase:1,deny,status:403,msg:'TeamCity path traversal attempt (CVE-2024-24942)'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
