CVE-2024-56356: JetBrains TeamCity XXE Vulnerability

CVE-2024-56356 Overview

CVE-2024-56356 is an XML External Entity (XXE) vulnerability in JetBrains TeamCity versions before 2024.12. The flaw stems from an insecure XMLParser configuration that fails to disable external entity resolution. An authenticated attacker with network access can supply crafted XML input to trigger entity expansion against the TeamCity server. Successful exploitation can expose sensitive server-side files and enable server-side request forgery against internal resources. The issue is tracked under CWE-611: Improper Restriction of XML External Entity Reference.

Critical Impact
Authenticated attackers can read local files on the TeamCity server and probe internal network services through XXE injection.

Affected Products

JetBrains TeamCity versions prior to 2024.12
On-premises TeamCity server deployments
CI/CD pipelines relying on affected TeamCity builds

Discovery Timeline

2024-12-20 - CVE-2024-56356 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56356

Vulnerability Analysis

The vulnerability resides in an XML parser used by TeamCity to process XML input. The parser is instantiated without disabling external entity resolution or DTD processing. When an attacker submits XML containing a crafted external entity reference, the parser dereferences the entity during parsing. This behavior enables retrieval of file contents from the server file system and outbound requests to internal endpoints. Because the attack occurs over the network against an authenticated API surface, exploitation requires only a low-privilege user account. Confidentiality impact is high, while integrity impact is limited to what the XXE primitive can achieve.

Root Cause

The root cause is missing hardening on the XMLParser instance. Secure XML processing requires disabling external general entities, external parameter entities, and inline DTD declarations. The affected TeamCity builds omit these safeguards, leaving default entity resolution enabled. This aligns with the [CWE-611] weakness pattern of insufficient XML parser configuration.

Attack Vector

An authenticated user submits an HTTP request containing an XML document to a TeamCity endpoint that invokes the vulnerable parser. The document declares an external entity referencing a local file path such as file:///etc/passwd or an internal HTTP resource. When TeamCity parses the payload, it resolves the entity and reflects or transmits the resolved content. Attackers commonly chain XXE with error-based exfiltration or out-of-band DNS callbacks when direct reflection is not available. See the JetBrains Security Issues Fixed advisory for vendor-supplied technical context.

Detection Methods for CVE-2024-56356

Indicators of Compromise

Inbound HTTP requests to TeamCity endpoints containing <!DOCTYPE, <!ENTITY, or SYSTEM declarations in XML payloads
TeamCity process reading unexpected local files such as /etc/passwd, web.xml, or configuration secrets
Outbound network connections from the TeamCity server to attacker-controlled DNS or HTTP listeners
Anomalous XML parsing errors logged during authenticated build configuration or REST API operations

Detection Strategies

Inspect TeamCity access logs for POST or PUT requests carrying XML bodies with external entity declarations
Correlate authenticated TeamCity API activity with subsequent file-read syscalls originating from the TeamCity JVM
Alert on outbound egress from the TeamCity server to non-approved destinations, particularly during API request handling

Monitoring Recommendations

Enable verbose XML request logging on TeamCity and forward logs to a central analytics platform for pattern matching
Monitor low-privilege TeamCity accounts for atypical API usage volumes and XML content types
Track patch state of all TeamCity instances against version 2024.12 or later

How to Mitigate CVE-2024-56356

Immediate Actions Required

Upgrade all TeamCity servers to version 2024.12 or later, which contains the vendor fix
Audit TeamCity user accounts and revoke unnecessary API access for low-privilege identities
Restrict outbound network access from the TeamCity server to only required destinations to blunt out-of-band XXE exfiltration
Review recent TeamCity logs for XML payloads containing entity declarations submitted before the patch was applied

Patch Information

JetBrains addressed the vulnerability in TeamCity 2024.12. Administrators should consult the JetBrains Security Issues Fixed page for the full advisory and download the fixed build from the official JetBrains distribution channels. There are no partial patches; upgrading is the supported remediation.

Workarounds

Place the TeamCity server behind a reverse proxy or web application firewall that inspects and blocks XML payloads containing <!ENTITY or SYSTEM keywords
Enforce network segmentation so the TeamCity server cannot reach sensitive internal services or the public internet without explicit allowlisting
Reduce the number of authenticated users with permission to reach XML-processing endpoints until patching is complete

bash

# Example egress restriction using iptables to limit TeamCity server outbound traffic
iptables -A OUTPUT -o eth0 -d <artifact-repo-ip> -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -o eth0 -d <vcs-server-ip> -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -o eth0 -j DROP