TeamCity jsp= Path Auth Bypass

Product: JetBrains TeamCity On-Premises
CVE: CVE-2024-27198
Disclosed: 2024-03-04
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: < 2023.11.4
Fixed: 2023.11.4

Summary

Rapid7 found that appending a ';.jsp' path parameter to a request that 404s lets it reach any authenticated TeamCity endpoint. Attackers create admin users or tokens and then run commands via plugins or build agents; it was exploited for ransomware within days.

Root cause

TeamCity's BaseController treats a request with a 'jsp' parameter ending in '.jsp' on an unmapped path as a JSP view, forwarding to the attacker-chosen path. The forward happens after the auth interceptor decided the original URI needed no authentication, so /hax?jsp=/app/rest/users;.jsp reaches the REST API as anonymous.

Impact

Unauthenticated full admin takeover of the CI server and RCE.

Public PoC

POST /hax?jsp=/app/rest/users;.jsp HTTP/1.1
Host: target:8111
Content-Type: application/json

{"username": "hacker", "password": "hacker", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

Source: vulhub / teamcity/CVE-2024-27198

Detection

Search logs for requests with 'jsp=' and ';.jsp', and unexpected new admin users/tokens. nuclei template CVE-2024-27198.

Mitigation

Upgrade to 2023.11.4+ or install the JetBrains security patch plugin.