CVE-2024-27199
HIGH KEV RANSOMWARE NUCLEITeamCity < 2023.11.4 - Authentication Bypass
Title source: nucleiExploitation Summary
CVE-2024-27199 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added April 20, 2026, with confirmed use in ransomware campaigns. EIP tracks 2 public exploits from researchers including Stuub. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-27198, targeting JetBrains TeamCity. The exploit creates an admin user and achieves RCE by leveraging an authentication bypass vulnerability in the REST API endpoint.
Description
In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
Exploits (2)
This repository contains a functional exploit for CVE-2024-27198, targeting JetBrains TeamCity. The exploit creates an admin user and achieves RCE by leveraging an authentication bypass vulnerability in the REST API endpoint.
This repository contains a functional exploit for CVE-2024-27198, targeting TeamCity's plugin upload mechanism to achieve remote code execution (RCE). The exploit automates the process of uploading a malicious plugin, leveraging authentication tokens and CSRF protection bypasses.
Nuclei Templates (1)
http.component:"TeamCity"
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L