What happened?
On 4 March 2024, JetBrains disclosed CVE-2024-27198, an authentication bypass in TeamCity — the self-hosted CI/CD server thousands of enterprises trust to build their software — followed within days by CVE-2024-27199, a path traversal. Rated 9.8 and 8.5, the pair meant: reach the web port, become an administrator, run arbitrary code on build agents. By 11 March, when this post’s publish date sits, mass exploitation was well underway and ransomware crews — the same families that hit TeamCity throughout late 2023 — were again queuing at the door of build infrastructure.
Quick Answer: CVE-2024-27198 (-27199) let unauthenticated attackers create admin accounts on JetBrains TeamCity CI servers, granting code execution on every connected build agent; exploited within days of March 2024 disclosure, it became ransomware’s preferred entry into software factories — because owning the build server means owning everything it builds.
The flaw class was almost boring: an alternate-path routing quirk allowed requests to bypass authentication and reach administrative endpoints — create users, grant roles. From there the flow writes itself. Admin leads to build-configuration edit; build configs execute arbitrary scripts on agents; agents run with repository credentials, cloud keys, signing material, production deploy tokens. A CI server is a privileged orchestrator by design, so a single auth bypass converts to total pipeline compromise. For organizations whose TeamCity faced the internet — years of exposure data showed tens of thousands — the patch clock started at disclosure minus zero.
The ransomware on-ramp, again
This was not TeamCity’s first rodeo — 2023 saw the same product targeted via CVE-2023-42793 by groups ranging from cryptominer operators to ransomware crews. The 2024 wave confirmed the pattern: build servers are tier-zero targets. Observed payloads included coin miners as rapid canaries and pre-encryption recon; the serious operators — Black Basta-linked clusters were reported among the opportunists — treated TeamCity access as durable foothold material: inject dependencies, backdoor artifacts, save the encryption for valuation-appropriate victims.
| Date | Event |
|---|---|
| 2024-03-04 | JetBrains discloses CVE-2024-27198 (auth bypass, CVSS 9.8); patch available same day |
| 2024-03-05→07 | Second flaw CVE-2024-27199 detailed; CISA KEV listing; honeypots record mass scanning |
| 2024-03-11 | In-the-wild exploitation documented; miners and recon payloads observed on unpatched servers |
| 2024-03-25 | Ransomware pre-staging reported; threat actors banking TeamCity access for later use |
| 2024-04 | Follow-on guidance: rotate all agent credentials, audit build scripts and artifacts produced during exposure windows |
The exposure census nobody owned
Scanning archives suggested tens of thousands of internet-facing TeamCity consoles at disclosure time — a population nobody could precisely enumerate because CI ownership sits between development and infrastructure teams. The patch-gap analysis fell to security functions pulling asset inventories backwards. Enterprises that could answer “where is our CI, who owns it, when did it last patch” within hours closed their windows; those that spent a week deciding whose job the question was became statistics in the follow-up exploitation reports.
Why CI is the crown jewels’ anteroom
Modern CI servers hold, at various moments: source for every product, secrets for every environment, signing keys for release artifacts, and the machinery to publish. Compromise at build time is worse than compromise at rest — the attacker inherits distribution. That’s why the SolarWinds lesson keeps echoing through every TeamCity, Jenkins, and GitLab-runner incident: the build system is not adjacent to the product; it is the product’s provenance.
- Secrets sprawl: agents hold cloud creds, tokens, DB passwords — pivot-ready credentials for production estates.
- Artifact poisoning: malicious build steps inject backdoors into binaries customers will trust and update automatically.
- Key material: code-signing keys accessed at build time convert access into forged-update capability.
- Legit exec channel: CI scheduling provides attacker-controlled code execution with logging that blends into normal build noise.
FAQ
How bad was CVE-2024-27198 without the second flaw?
Fully weaponizable alone: the auth bypass permitted account creation directly. The path traversal (-27199) added depth and file-read reach, but attackers needed only the first — one request to an exposed endpoint, then a legitimate administrator exists. Patching velocity on the primary CVE was the whole ballgame.
Were cloud TeamCity users affected?
No — JetBrains Cloud handled the fix server-side with no customer action. The exposed population was self-hosted: enterprises and teams running TeamCity on their own hardware, often internet-facing for agent convenience. The incident re-ignited the clouds-vs-selfhosted CI debate with fresh ammunition.
What does “assume build compromise” response look like?
Rotate every secret the server and agents touched; rebuild artifacts from clean states rather than trusting cached builds; audit build histories for unexpected configuration changes, new admin accounts, and modified build scripts; and re-validate release signatures issued during the exposure window. Then segment: the CI that builds the product should never hold production credentials it doesn’t strictly need.
Repeated lessons from 2023’s version
Everything the 2024 wave punished had been punished before: CVE-2023-42793’s exploitation in September 2023 pre-demonstrated the auth-bypass-to-RCE flow, and the guidance then — patch, rotate, audit builds — matched 2024’s word for word. The delta year-over-year was attacker readiness: initial-access crews had standing TeamCity playbooks, so the interval from disclosure to first observed victim shortened. Repetition is the signal defenders should heed: when the same product family is hit twice in twelve months, the third attempt is already scheduled.
Lessons for the software factory
The TeamCity episode of early 2024, sandwiched between the XZ near-miss and the ongoing ransomware surges, closed the argument: build infrastructure warrants the same security tier as domain controllers. Practical outcomes across the industry — management consoles off the internet, MFA and SSO on admin planes, ephemerally-credentialed agents, signed and attested build outputs with provenance trails. The organizations that internalized 2024’s CI incidents spent the year rebuilding the software factory with zero-trust walls; the ones that didn’t remained in the ransomware queue, hoping their exposure window hadn’t already been banked.
Detection and response playbook
The TeamCity auth bypass (CVE-2023-42793) put every unpatched build server one request away from administrative access — and CI systems are the anteroom to the crown jewels: source code, signing keys, deployment credentials, and the pipelines that move them all to production. Ransomware crews and state actors alike treated it as an on-ramp within days of disclosure.
- Know where every CI instance lives, including the forgotten ones. TeamCity, Jenkins, GitLab runners, self-hosted GitHub Actions — attack-surface scans routinely find build infrastructure that asset databases missed, exposed to the internet because a team needed temporary access and never closed it. Build servers belong behind VPN, full stop; the entire category has too much privilege for direct exposure.
- Hunt for the token harvest after any CI CVE. The first thing attackers pull from a build server is everything it can reach: access tokens from configuration files, registry credentials from environment variables, SSH keys from agent workspaces, and signing material from pipelines. Post-advisory triage is a secrets-rotation event with the CI system as the map of what to rotate.
- Detect pipeline tampering, not just access. Compromised CI is most dangerous when attackers modify build steps — injecting into scripts, adding a build phase that exfiltrates artifacts. Alert on pipeline definition changes outside change windows, new build agents appearing, and build outputs whose signatures do not match the source revision.
- Segment the software factory. Build infrastructure sits in a unique position: untrusted input (pull requests) meets trusted output (deployable artifacts). Egress-restricted build environments, isolated runners per project, and separation between build and publish credentials contain both accidental and malicious cross-contamination. The supply-chain guide formalizes this architecture.
- Rehearse the golden-path rebuild. If your CI were compromised tomorrow, could you rebuild it from code and re-establish trust in the artifacts it produces? Organizations that answered yes did so by versioning pipeline definitions, keeping signing keys outside CI, and documenting the rebuild. Everyone else discovered their build system was also their only proof of provenance.
Where this sits in the broader pattern
TeamCity 2023 belongs to the build-infrastructure intrusion lineage: the 2021 Codecov supply-chain compromise (build-script tampering that harvested environment credentials across thousands of pipelines), the 2021 ProxyLogon-into-build-server chains, the xz backdoor on the maintainer side, and the Sisense breach — the same month, the same lesson. The pattern: attackers learned that CI is the highest-concentration credential store in most organizations, protected like an internal wiki.
The ransomware connection made it commercial. Bassterlord and affiliate crews explicitly documented build servers in their playbooks — not for the source code, but for the domain admin credentials that build pipelines cached. A CI compromise converts to domain compromise in minutes in networks where pipeline credentials over-scoped, which is most networks.
The industry response — SLSA and supply-chain levels for build integrity, ephemeral build environments, keyless signing — all addresses this one asymmetry: the build system transforms untrusted input into trusted output, so it deserves the strongest isolation in the estate. Every incident in this lineage is the same lesson with a different vendor name attached.
The bottom line. A build server is a credential vault wearing a web interface, and CVE-2023-42793 proved one unauthenticated request opens it. Put CI behind VPN, treat every related advisory as a secrets-rotation event, segment the software factory, and keep your signing keys somewhere the pipeline can use but an attacker who owns the pipeline cannot. The artifacts you ship are only as trustworthy as the machine that built them.
Frequently Asked Questions
{“@context”:”https://schema.org”,”@type”:”FAQPage”,”mainEntity”:[{“@type”:”Question”,”name”:”What is CVE-2023-42793 in JetBrains TeamCity?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”An authentication bypass in TeamCity On-Premises (fixed in 2023.05.4) allowing unauthenticated attackers to gain administrative access to build servers — which hold source code, signing keys, and deployment credentials — exploited by both ransomware and state actors within days of disclosure.”}},{“@type”:”Question”,”name”:”Why do attackers target CI and build servers?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Because build infrastructure concentrates privilege: tokens, registry credentials, SSH keys, and signing material are all cached there, and pipeline credentials are frequently over-scoped. Owning the build server often converts directly to owning production or the domain.”}},{“@type”:”Question”,”name”:”How should build servers be secured?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Keep them off the internet behind VPN, treat CI vulnerabilities as immediate secrets-rotation events, alert on pipeline-definition tampering, isolate build environments with restricted egress, and hold signing keys outside the CI system itself.”}}]}
Related Reading
- What Studying 33 Historic Cyberattacks Taught Me About Defending Systems Today
- Passwordless in 2026: Why Passkeys Are Finally Killing the Password (and How Attackers Are Adapting)
- 2022–2024: Lapsus$, Change Healthcare & the XZ Backdoor
- Authoritative reference: CISA Known Exploited Vulnerabilities
- CVE-2024-10924: Really Simple Security’s 2FA Betrayal
- MOVEit’s Ledger: 2,700 Orgs, 93 Million People
- MOVEit Transfer Zero-Day: Cl0p’s Memorial Day Heist
