JetBrains TeamCity CVE-2024-27199

The TeamCity server's web interface (default port 8111 or behind a reverse proxy) must be network-reachable by the attacker, and the server must be running a vulnerable version prior to 2023.11.4. No user interaction is required and exploitation targets default TeamCity deployments without needing special configuration. Limiting factors: instances that are not internet-exposed or that sit behind authenticating reverse proxies/VPNs are significantly harder to reach, and TeamCity Cloud tenants are vendor-managed and out of scope for customer action.

Real-world risk is high and signals are consistent: CISA KEV listing confirms in-the-wild exploitation, EPSS at 82.47% (99th percentile) indicates extremely high exploitation probability, and public POCs are available - all reinforcing each other rather than conflicting. The CVSS base score is 7.3 (High) but the full CVSS vector is not provided in the input, so attack vector, complexity, and privilege requirements cannot be confirmed from CVSS alone; the description and exploitation pattern strongly imply network-reachable, unauthenticated abuse, but this should be verified against the JetBrains advisory. The disclosed scope is 'limited admin actions' rather than direct RCE, but in CI/CD contexts limited admin access (e.g., creating users, modifying tokens) frequently chains to full server compromise, which is consistent with observed in-the-wild use.

An attacker on the internet sends crafted HTTP requests to an exposed TeamCity server containing path traversal sequences targeting administrative endpoints, bypassing the authentication gate that should protect them. Using the resulting limited admin access, the attacker creates a new administrator account or generates an API token, then pivots to executing build configurations that run arbitrary code on build agents and exfiltrates source code or deployment secrets. Public POCs demonstrating this chain exist, lowering the skill barrier substantially.