CVE-2024-54155 Overview
CVE-2024-54155 is an improper access control vulnerability in JetBrains YouTrack versions prior to 2024.3.51866. The flaw allows unauthenticated remote attackers to list project names during the app import workflow. No credentials or user interaction are required to trigger the disclosure. The issue is categorized under [CWE-862] Missing Authorization and [CWE-306] Missing Authentication for Critical Function.
Critical Impact
Unauthenticated attackers can enumerate internal YouTrack project names over the network, exposing organizational structure and aiding reconnaissance for follow-on attacks.
Affected Products
- JetBrains YouTrack versions prior to 2024.3.51866
- Self-hosted YouTrack Server deployments
- YouTrack instances exposing the app import endpoint to untrusted networks
Discovery Timeline
- 2024-12-04 - CVE-2024-54155 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-54155
Vulnerability Analysis
The vulnerability resides in the YouTrack application import functionality. The endpoint used during app import does not enforce authentication or authorization checks before returning project metadata. As a result, any network-reachable client can invoke the workflow and receive a list of project names configured within the YouTrack instance.
While the disclosure is limited to project names, the information supports reconnaissance activities. Attackers can identify internal teams, product lines, or customer engagements referenced in project naming conventions. This data can then feed phishing campaigns, credential stuffing target lists, or lateral movement planning against related JetBrains ecosystem services.
Root Cause
The root cause is a missing authorization check on the app import handler. JetBrains addressed the flaw by adding proper access control enforcement so that only authenticated users with appropriate privileges can invoke the import operation and view project metadata.
Attack Vector
Exploitation occurs over the network against the YouTrack HTTP interface. The attacker sends a crafted request to the app import endpoint without providing session cookies, API tokens, or other credentials. The server processes the request and returns project name data in the response. No user interaction is required on the victim side.
The vulnerability manifests in the app import request handler. Refer to the JetBrains Security Issues Fixed advisory for vendor-provided technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2024-54155
Indicators of Compromise
- Unauthenticated HTTP requests to YouTrack app import endpoints originating from unexpected source addresses
- Access log entries showing successful responses to import-related URIs without a preceding authentication event
- Anomalous scanning patterns targeting /api/ or app import paths on YouTrack servers
Detection Strategies
- Review YouTrack HTTP access logs for import endpoint calls that lack authentication tokens or session identifiers
- Deploy web application firewall rules to alert on anonymous requests reaching administrative or import URIs
- Correlate reconnaissance activity across network telemetry to identify follow-on targeting of exposed project names
Monitoring Recommendations
- Forward YouTrack application and access logs to a centralized logging platform for retention and query
- Baseline normal traffic volumes to import endpoints and alert on deviations
- Track the installed YouTrack build number and flag any host still running versions below 2024.3.51866
How to Mitigate CVE-2024-54155
Immediate Actions Required
- Upgrade all self-hosted YouTrack instances to version 2024.3.51866 or later
- Inventory internet-facing YouTrack deployments and prioritize patching for externally exposed hosts
- Review historical access logs for signs of prior enumeration against the app import endpoint
Patch Information
JetBrains fixed CVE-2024-54155 in YouTrack 2024.3.51866. Administrators should consult the JetBrains Security Issues Fixed page for release notes and upgrade instructions. JetBrains Cloud-hosted YouTrack instances are updated by the vendor.
Workarounds
- Restrict network access to the YouTrack server using firewall rules or VPN gating until the patch is applied
- Place YouTrack behind a reverse proxy that enforces authentication before requests reach the application
- Limit exposure of the app import endpoint through URL-based access controls at the proxy layer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
