CVE-2024-56349: JetBrains TeamCity Auth Bypass Vulnerability

CVE-2024-56349 Overview

CVE-2024-56349 affects JetBrains TeamCity versions prior to 2024.12. The vulnerability stems from improper access control [CWE-862] that allows unauthorized users to modify build logs. TeamCity is a widely deployed continuous integration and continuous delivery (CI/CD) server used by development teams to automate build, test, and release pipelines. An attacker exploiting this flaw can tamper with build log integrity, potentially concealing malicious activity in CI/CD pipelines or misleading auditors reviewing build history.

Critical Impact
Unauthorized modification of build logs can undermine CI/CD audit trails and hide evidence of tampering with build artifacts.

Affected Products

JetBrains TeamCity versions before 2024.12
TeamCity on-premises installations
All deployments exposing the affected build log endpoint

Discovery Timeline

2024-12-20 - CVE-2024-56349 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56349

Vulnerability Analysis

The vulnerability is an improper access control weakness in the TeamCity build log handling logic. TeamCity did not sufficiently verify that a requesting user held the required permissions before accepting modifications to build log data. As a result, unauthorized users can alter log content that should be immutable historical evidence of build execution.

Build logs in a CI/CD system serve as the authoritative record of compilation, testing, and packaging steps. When log integrity is compromised, downstream trust in build outputs weakens. Investigators cannot rely on the logs to reconstruct pipeline behavior or attribute changes to specific commits.

The issue is network-reachable and requires no authentication or user interaction according to the published CVSS vector. Impact is limited to integrity of build log data; confidentiality and availability are not directly affected.

Root Cause

The root cause is a missing authorization check [CWE-862] on the code path that accepts build log modifications. TeamCity treated the request as trusted without validating the caller's role or project-level permissions against the target log resource.

Attack Vector

An unauthenticated remote attacker with network access to a vulnerable TeamCity server can send crafted requests to the log modification endpoint. Because no privileges are required, exploitation only depends on reachability of the TeamCity web interface. Public-facing TeamCity instances face the highest exposure. See the JetBrains Security Issues Fixed page for vendor details.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Detection Methods for CVE-2024-56349

Indicators of Compromise

Unexpected changes to build log content that do not correspond to a completed build run
Build log entries with timestamps that do not align with pipeline execution windows
Requests to build log endpoints originating from unauthenticated sessions or unusual source IP addresses

Detection Strategies

Compare build log hashes or sizes over time to identify silent modifications after a build completes
Review TeamCity access logs for HTTP requests targeting build log resources without an authenticated user context
Correlate build log modification events with source control commit history to surface inconsistencies

Monitoring Recommendations

Forward TeamCity server access and audit logs to a centralized SIEM for retention and correlation
Alert on any modification of build logs belonging to completed or archived builds
Track the TeamCity server version across your estate to confirm patched builds are deployed

How to Mitigate CVE-2024-56349

Immediate Actions Required

Upgrade JetBrains TeamCity to version 2024.12 or later on all servers
Restrict network access to the TeamCity web interface using firewall rules or VPN gating
Audit existing build logs for signs of unauthorized modification before applying the patch

Patch Information

JetBrains resolved the issue in TeamCity 2024.12. Administrators should review the JetBrains Security Issues Fixed advisory and follow the standard TeamCity upgrade procedure. Back up the TeamCity data directory and database before upgrading.

Workarounds

Place TeamCity behind an authenticated reverse proxy that blocks anonymous requests to log endpoints
Limit exposure of the TeamCity server to trusted internal networks only until patching is complete
Increase audit log retention to preserve evidence of any tampering attempts prior to remediation

bash

# Configuration example: restrict TeamCity access at the reverse proxy layer
# nginx snippet enforcing IP allow-listing for the TeamCity web UI
location / {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://teamcity-backend:8111;
}