What happened?
On 4 March 2024, JetBrains disclosed CVE-2024-27198, an authentication bypass in TeamCity — the self-hosted CI/CD server thousands of enterprises trust to build their software — followed within days by CVE-2024-27199, a path traversal. Rated 9.8 and 8.5, the pair meant: reach the web port, become an administrator, run arbitrary code on build agents. By 11 March, when this post’s publish date sits, mass exploitation was well underway and ransomware crews — the same families that hit TeamCity throughout late 2023 — were again queuing at the door of build infrastructure.
Quick Answer: CVE-2024-27198 (-27199) let unauthenticated attackers create admin accounts on JetBrains TeamCity CI servers, granting code execution on every connected build agent; exploited within days of March 2024 disclosure, it became ransomware’s preferred entry into software factories — because owning the build server means owning everything it builds.
The flaw class was almost boring: an alternate-path routing quirk allowed requests to bypass authentication and reach administrative endpoints — create users, grant roles. From there the flow writes itself. Admin leads to build-configuration edit; build configs execute arbitrary scripts on agents; agents run with repository credentials, cloud keys, signing material, production deploy tokens. A CI server is a privileged orchestrator by design, so a single auth bypass converts to total pipeline compromise. For organizations whose TeamCity faced the internet — years of exposure data showed tens of thousands — the patch clock started at disclosure minus zero.
The ransomware on-ramp, again
This was not TeamCity’s first rodeo — 2023 saw the same product targeted via CVE-2023-42793 by groups ranging from cryptominer operators to ransomware crews. The 2024 wave confirmed the pattern: build servers are tier-zero targets. Observed payloads included coin miners as rapid canaries and pre-encryption recon; the serious operators — Black Basta-linked clusters were reported among the opportunists — treated TeamCity access as durable foothold material: inject dependencies, backdoor artifacts, save the encryption for valuation-appropriate victims.
| Date | Event |
|---|---|
| 2024-03-04 | JetBrains discloses CVE-2024-27198 (auth bypass, CVSS 9.8); patch available same day |
| 2024-03-05→07 | Second flaw CVE-2024-27199 detailed; CISA KEV listing; honeypots record mass scanning |
| 2024-03-11 | In-the-wild exploitation documented; miners and recon payloads observed on unpatched servers |
| 2024-03-25 | Ransomware pre-staging reported; threat actors banking TeamCity access for later use |
| 2024-04 | Follow-on guidance: rotate all agent credentials, audit build scripts and artifacts produced during exposure windows |
The exposure census nobody owned
Scanning archives suggested tens of thousands of internet-facing TeamCity consoles at disclosure time — a population nobody could precisely enumerate because CI ownership sits between development and infrastructure teams. The patch-gap analysis fell to security functions pulling asset inventories backwards. Enterprises that could answer “where is our CI, who owns it, when did it last patch” within hours closed their windows; those that spent a week deciding whose job the question was became statistics in the follow-up exploitation reports.
Why CI is the crown jewels’ anteroom
Modern CI servers hold, at various moments: source for every product, secrets for every environment, signing keys for release artifacts, and the machinery to publish. Compromise at build time is worse than compromise at rest — the attacker inherits distribution. That’s why the SolarWinds lesson keeps echoing through every TeamCity, Jenkins, and GitLab-runner incident: the build system is not adjacent to the product; it is the product’s provenance.
- Secrets sprawl: agents hold cloud creds, tokens, DB passwords — pivot-ready credentials for production estates.
- Artifact poisoning: malicious build steps inject backdoors into binaries customers will trust and update automatically.
- Key material: code-signing keys accessed at build time convert access into forged-update capability.
- Legit exec channel: CI scheduling provides attacker-controlled code execution with logging that blends into normal build noise.
FAQ
How bad was CVE-2024-27198 without the second flaw?
Fully weaponizable alone: the auth bypass permitted account creation directly. The path traversal (-27199) added depth and file-read reach, but attackers needed only the first — one request to an exposed endpoint, then a legitimate administrator exists. Patching velocity on the primary CVE was the whole ballgame.
Were cloud TeamCity users affected?
No — JetBrains Cloud handled the fix server-side with no customer action. The exposed population was self-hosted: enterprises and teams running TeamCity on their own hardware, often internet-facing for agent convenience. The incident re-ignited the clouds-vs-selfhosted CI debate with fresh ammunition.
What does “assume build compromise” response look like?
Rotate every secret the server and agents touched; rebuild artifacts from clean states rather than trusting cached builds; audit build histories for unexpected configuration changes, new admin accounts, and modified build scripts; and re-validate release signatures issued during the exposure window. Then segment: the CI that builds the product should never hold production credentials it doesn’t strictly need.
Repeated lessons from 2023’s version
Everything the 2024 wave punished had been punished before: CVE-2023-42793’s exploitation in September 2023 pre-demonstrated the auth-bypass-to-RCE flow, and the guidance then — patch, rotate, audit builds — matched 2024’s word for word. The delta year-over-year was attacker readiness: initial-access crews had standing TeamCity playbooks, so the interval from disclosure to first observed victim shortened. Repetition is the signal defenders should heed: when the same product family is hit twice in twelve months, the third attempt is already scheduled.
Lessons for the software factory
The TeamCity episode of early 2024, sandwiched between the XZ near-miss and the ongoing ransomware surges, closed the argument: build infrastructure warrants the same security tier as domain controllers. Practical outcomes across the industry — management consoles off the internet, MFA and SSO on admin planes, ephemerally-credentialed agents, signed and attested build outputs with provenance trails. The organizations that internalized 2024’s CI incidents spent the year rebuilding the software factory with zero-trust walls; the ones that didn’t remained in the ransomware queue, hoping their exposure window hadn’t already been banked.
