{"uuid": "4898beef-8c16-46f6-9c5f-840ee7fcd724", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27198", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2024_27198.rb", "content": "{\"aliases\": [], \"arch\": \"java, cmd\", \"author\": [\"sfewer-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an authentication bypass vulnerability in JetBrains TeamCity. An unauthenticated\\n          attacker can leverage this to access the REST API and create a new administrator access token. This token\\n          can be used to upload a plugin which contains a Metasploit payload, allowing the attacker to achieve\\n          unauthenticated RCE on the target TeamCity server. On older versions of TeamCity, access tokens do not exist\\n          so the exploit will instead create a new administrator account before uploading a plugin. Older version of\\n          TeamCity have a debug endpoint (/app/rest/debug/process) that allows for arbitrary commands to be executed,\\n          however recent version of TeamCity no longer ship this endpoint, hence why a plugin is leveraged for code\\n          execution instead, as this is supported on all versions tested.\", \"disclosure_date\": \"2024-03-04\", \"fullname\": \"exploit/multi/http/jetbrains_teamcity_rce_cve_2024_27198\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"JetBrains TeamCity Unauthenticated Remote Code Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2024_27198.rb\", \"platform\": \"Java,Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/jetbrains_teamcity_rce_cve_2024_27198\", \"references\": [\"CVE-2024-27198\", \"EDB-52411\", \"URL-https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/\", \"URL-https://blog.jetbrains.com/teamcity/2024/03/teamcity-2023-11-4-is-out/\"], \"rport\": 8111, \"session_types\": false, \"targets\": [\"Java\", \"Java Server Page\", \"Windows Command\", \"Linux Command\", \"Unix Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:59.718665Z"}