How to find TeamCity instances


What is TeamCity? #

TeamCity is a JetBrains product that allows customers to combine the practices of Continuous Integration with Continuous Delivery, or CICD to build and deliver their software. This makes the patching of this vulnerability of higher importance since it would allow an attacker a potential foothold into the supply chain of products built using the TeamCity On-Premises product. Although JetBrains provides a cloud-hosted instance of TeamCity, only customer-hosted instances, which include the Professional and Enterprise editions are currently affected by the vulnerability.

Latest TeamCity vulnerabilities #

On March 3rd, 2024, JetBrains disclosed two serious vulnerabilities in the TeamCity On-Premises product.

The first issue, CVE-2024-27198, allows attackers to bypass authentication controls and access the TeamCity installation with administrative privileges. This issue has been given a CVSS score of 9.8, indicating a highly critical vulnerability.

The second issue, CVE-2024-27199, is a path-traversal vulnerability allowing attackers to perform limited administative actions without proper authentication. This issue has been given a CVSS score of 7.3, indicating a high severity.

What is the impact? #

Upon successful exploitation of these vulnerabilities, attackers can execute arbitrary commands on the vulnerable system. This includes the creation of new users, installation of additional modules or code, and, in general, system compromise.

Are updates/workarounds available? #

JetBrains has released an update to mitigate this issue. Users are urged to update as quickly as possible.

How to find potentially vulnerable TeamCity installations with runZero? #

TeamCity On-Premises assets can be found by navigating to the Asset Inventory and using the following pre-built query to locate TeamCity services on your network:


Results from the above query should be triaged to determine if they require patching or vendor intervention. Additional fingerprinting research is ongoing, and additional queries will be published as soon as possible.

CVE-2024-23917 (February 2024) #

On February 6th, 2024, JetBrains disclosed a serious vulnerability, CVE-2024-23917, allowing attackers who can access the TeamCity installation via HTTPS to bypass authentication mechanisms and gain administrative privileges on the affected systems.

JetBrains released an update to mitigate this issue. Users were urged to update as quickly as possible.

CVE-2023-42793 (September 2023) #

On September 20th, 2023, JetBrains announced a critical authentication bypass vulnerability that impacted users running the TeamCity On-Premises product. The vulnerability was tracked using CVE-2023-42793, and presented the weakness of CWE-288 (Authentication Bypass Using an Alternate Path or Channel). Successfully exploiting this vulnerability would allow an unauthenticated remote attacker to perform a Remote Code Execution (RCE) attack and gain administrative access to the underlying system.

JetBrains issued a patch for this vulnerability in revision 2023.05.4, encouraging all users to upgrade. For users that could not immediately apply the update, a security patch plugin was also made available. More information can be found on JetBrain’s website.

Written by HD Moore

HD Moore is the co-founder and CEO of runZero. Previously, he founded the Metasploit Project and served as the main developer of the Metasploit Framework, which is the world's most widely used penetration testing framework.
More about HD Moore

Written by Rob King

Rob King is the Director of Security Research at runZero. Over his career Rob has served as a senior researcher with KoreLogic, the architect for TippingPoint DVLabs, and helped get several startups off the ground. Rob helped design SC Magazine's Data Leakage Prevention Product of the Year for 2010, and was awarded the 3Com Innovator of the Year Award in 2009. He has been invited to speak at BlackHat, Shmoocon, SANS Network Security, and USENIX.

More about Rob King
Subscribe Now

Get the latest news and expert insights delivered in your inbox.

Welcome to the club! Your subscription to our newsletter is successful.

Related Articles

Rapid Response
How to find Palo Alto Network firewalls running PAN-OS 11.1, 11.0, and 10.2
Palo Alto Networks disclosed that versions of their PAN-OS software have a vulnerability allowing for remote command injection. Here's how to find...
Rapid Response
How to find CrushFTP services
CrushFTP disclosed that versions of their file transfer software have a vulnerability allowing unauthenticated file system access. Here's how to...
Rapid Response
How to find outdated lighttpd services
Outdated versions of the open source lighttpd web server are vulnerable to a handful of security vulnerabilities
Rapid Response
How to find D-Link NAS Storage devices
D-Link has disclosed multiple vulnerabilities in their D-Link NAS Storage products. Here's how to find potentially impacted devices.

See Results in Minutes

Get complete visibility into IT, OT, & IoT — without agents, credentials, or hardware.

© Copyright 2024 runZero, Inc. All Rights Reserved