Vulnerability record · CVE-2024-23917 · published 6 February 2024
CVE-2024-23917: JetBrains TeamCity authentication bypass leads to remote code execution
Jetbrains · Teamcity
JetBrains TeamCity before 2023.11.3 contains an authentication bypass that allows an unauthenticated attacker to reach a critical function and achieve remote code execution. Because the flaw requires no credentials or user interaction and the server is network-facing, it is a serious risk to any exposed TeamCity instance.
Description
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated network-reachable RCE with a CVSS score of 9.8 and high EPSS probability makes this an urgent patching priority.
What it is
JetBrains TeamCity before 2023.11.3 contains an authentication bypass that allows an unauthenticated attacker to reach a critical function and achieve remote code execution. Because the flaw requires no credentials or user interaction and the server is network-facing, it is a serious risk to any exposed TeamCity instance.
Impact
An attacker gains unauthenticated remote code execution on the TeamCity server, which can lead to full compromise of the CI/CD environment, including build secrets, source code and connected systems.
Attack surface
Reachable over the network via the TeamCity web interface (CVSS vector AV:N/PR:N/UI:N), so no authentication and no user interaction are required. The record does not specify the exact endpoint or request path involved.
Exploitation
The record does not list this CVE in CISA KEV and provides no exploit reference tags, but EPSS is high at 0.5373 (99th percentile), indicating elevated likelihood of exploitation activity.
What to do
- Upgrade TeamCity to 2023.11.3 or later as the primary fix.
- If immediate upgrade is not possible, restrict network access to the TeamCity server to trusted networks and remove direct internet exposure.
- Review and rotate credentials, tokens and secrets stored in or reachable from TeamCity, since RCE may expose them.
- Audit TeamCity server logs and build history for unauthorized changes or unexpected build steps.
- Monitor vendor advisories for further guidance on affected versions and any interim workarounds.
Detection
- Review TeamCity server and web access logs for unauthenticated requests to administrative or build-triggering endpoints, especially from unfamiliar source IPs.
- Alert on unexpected creation or modification of build configurations, projects, users or plugins.
- Monitor for suspicious child processes spawned by the TeamCity server process (for example shells or download utilities).
- Watch for outbound connections from the TeamCity host to unknown external addresses that could indicate post-exploitation activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.jetbrains.com/privacy-security/issues-fixed/ | Vendor Advisory |
| https://www.jetbrains.com/privacy-security/issues-fixed/ | Vendor Advisory |
Track CVE-2024-23917 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-23917), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
