CVE-2024-47949: JetBrains TeamCity Path Traversal Flaw

CVE-2024-47949 Overview

CVE-2024-47949 is a path traversal vulnerability in JetBrains TeamCity versions before 2024.07.3. The flaw allows an attacker to write backup files to an arbitrary location on the server filesystem. The issue is categorized under CWE-22 and CWE-23, both covering improper limitation of pathnames to restricted directories. TeamCity is a widely deployed continuous integration and continuous delivery (CI/CD) server, making this defect relevant to build pipeline integrity. Attackers can exploit the issue over the network without user interaction, targeting the backup functionality to drop files into sensitive directories.

Critical Impact
Network-based path traversal enables backup file writes to arbitrary filesystem locations, threatening build server integrity and downstream CI/CD pipelines.

Affected Products

JetBrains TeamCity versions prior to 2024.07.3
TeamCity on-premises installations exposing the backup feature
CI/CD environments relying on vulnerable TeamCity server builds

Discovery Timeline

2024-10-08 - CVE-2024-47949 published to the National Vulnerability Database
2024-10-11 - Last updated in NVD database

Technical Details for CVE-2024-47949

Vulnerability Analysis

The vulnerability resides in TeamCity's backup handling logic. The application accepts a file path or filename parameter for backup output but fails to canonicalize and validate the value against an allowed base directory. An authenticated or otherwise reachable request supplying traversal sequences such as ../ causes the backup writer to resolve a path outside the intended backup directory. The result is an attacker-controlled write primitive constrained to backup file contents, but free in destination. Because TeamCity typically runs with privileges sufficient to manage build artifacts, configuration, and plugins, writes outside the backup directory can affect server behavior. The defect aligns with CWE-23, relative path traversal.

Root Cause

The root cause is missing or insufficient input validation on the backup destination parameter. The code path does not enforce that the resolved absolute path remains within the configured backup root. Filename sanitization does not reject parent directory references or absolute path overrides.

Attack Vector

The attack vector is network-based. An attacker reaches the TeamCity backup endpoint and submits a crafted request that includes path traversal sequences in the backup filename or location field. The server resolves the path and writes the backup archive to the attacker-specified location. Successful exploitation can overwrite or create files such as plugin directories, configuration files, or web-served resources, indirectly enabling persistence or further compromise.

No verified public exploit code is available at this time. The vulnerability mechanism is described in JetBrains' published advisory. See the JetBrains Fixed Issues Overview for vendor details.

Detection Methods for CVE-2024-47949

Indicators of Compromise

Unexpected files appearing outside the TeamCity backup directory, particularly under TeamCity/webapps, TeamCity/plugins, or system paths
HTTP requests to TeamCity backup endpoints containing ..\ or ../ sequences in path or filename parameters
Backup operations initiated outside normal administrative schedules or by unusual user accounts

Detection Strategies

Inspect TeamCity application logs (teamcity-server.log) for backup operations with anomalous target paths or unusual filename arguments
Deploy web application firewall (WAF) rules that flag traversal patterns in requests to /app/rest/server/backup and related endpoints
Correlate filesystem change events on the TeamCity host with backup API activity to identify out-of-scope writes

Monitoring Recommendations

Enable file integrity monitoring on TeamCity installation directories, plugin folders, and configuration paths
Forward TeamCity audit logs to a centralized SIEM and alert on backup actions invoked outside maintenance windows
Track outbound and lateral movement from the TeamCity host, since CI/CD servers are high-value pivot points

How to Mitigate CVE-2024-47949

Immediate Actions Required

Upgrade TeamCity to version 2024.07.3 or later as published by JetBrains
Restrict network access to the TeamCity web interface so only trusted administrators and build agents can reach it
Audit administrative accounts and revoke any tokens or credentials that may have been exposed on vulnerable instances
Review the TeamCity filesystem for unauthorized files written outside the designated backup directory

Patch Information

JetBrains addressed the issue in TeamCity 2024.07.3. Refer to the JetBrains Fixed Issues Overview for the official remediation notice. Apply the upgrade following JetBrains' documented procedure for on-premises servers, and verify the running version after the upgrade completes.

Workarounds

Place TeamCity behind an authenticating reverse proxy that blocks requests containing ../ or encoded traversal sequences targeting backup endpoints
Run the TeamCity service under a least-privilege account that cannot write to system or web-served directories outside its data folder
Disable or restrict the backup REST API to specific administrator source addresses until patching is complete

bash

# Example reverse proxy filter (NGINX) to block traversal patterns on backup endpoints
location /app/rest/server/backup {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e/|%2e%2e\\)") {
        return 403;
    }
    proxy_pass http://teamcity_upstream;
}