What is CVE-2024-27198?

CVE-2024-27198 is a critical vulnerability affecting JetBrains TeamCity software versions up to 2023.11.4. With a severity score of 9.8 out of 10, this authentication bypass issue allows remote unauthenticated attackers to execute arbitrary code and take complete control of affected instances.

Who is impacted by this?

This critical issue allows remote unauthenticated attackers to bypass authentication and execute arbitrary code, potentially taking complete control of affected instances. Organizations using the TeamCity CI/CD platform for automating build, testing, and deployment processes in software projects should be aware of this vulnerability and its potential impact on their systems.

What should I do if I’m affected?

If you're affected by the CVE-2024-27198 vulnerability, it's crucial to take immediate action to protect your systems. First, update your JetBrains TeamCity software to version 2023.11.4 or later to patch the vulnerability. Next, monitor your TeamCity instances for any suspicious activity and limit their exposure on the internet. Finally, check for unauthorized admin accounts on your TeamCity instances and remove them if necessary.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2024-27198 vulnerability, known as the JetBrains TeamCity Authentication Bypass Vulnerability, is indeed present in CISA's Known Exploited Vulnerabilities Catalog. It was added on March 7, 2024, and the due date for required action is March 28, 2024.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-288, which involves authentication bypass using an alternate path or channel.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• Dark Reading: JetBrains TeamCity Mass Exploitation Underway, Rogue Accounts Thrive

• JetBrains: Fixed Security Issues

• CISA: BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities

• CISA: Known Exploited Vulnerabilities Catalog