CVE-2024-27198

JetBrains TeamCity before 2023.11.4 contains an authentication-bypass flaw in its web request handling. By crafting a request that abuses how the server routes and authenticates certain URLs, an unauthenticated attacker can reach endpoints that should require administrator authentication and perform admin actions. From that administrative position the attacker can create accounts, alter configuration, and use TeamCity's own features to run code, effectively taking over the server.

TeamCity is a CI/CD build server, which places it at the heart of the software supply chain: it holds source access, signing keys, deployment credentials, and the ability to inject code into build artifacts. That makes an auth bypass here a supply-chain risk, not just a single-server compromise, and it was exploited rapidly at scale by ransomware crews and state-linked actors including groups attributed to Russian and North Korean operations. Upgrade to 2023.11.4 or apply JetBrains' security patch immediately, and given the fast, broad exploitation, treat exposed servers as suspect: audit for rogue admin accounts, rotate all credentials and signing keys the server held, and inspect recent builds for tampering.