---
title: "TeamCity Auth Bypass (CVE-2024-27198)"
canonical: https://trickest.com/library/teamcity-auth-bypass-check-cve-2024-27198
description: "Point hosts at TeamCity and flag CVE-2024-27198 by version, then confirm with a GET of /app/rest/server through the ?jsp= bypass. No token write. CISA KEV."
---

# TeamCity Auth Bypass (CVE-2024-27198)

## Overview

This workflow finds JetBrains TeamCity and sorts each host by whether its version falls in the CVE-2024-27198 range. CVE-2024-27198 is an unhandled path with a jsp query that skips the auth filter. Confirm reads server info only. CISA listed it on KEV after confirmed use. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from the public page, reads the version, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). Version flag is first. Hosts in range get a second node that GETs `/app/rest/server` through the `?jsp=` bypass. It does not create a token or user. This is the sibling of CVE-2024-27199 already in the Collection.

Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. Fingerprint each host as TeamCity, then read the version and compare it to the CVE-2024-27198 floors in the graph.
3. Confirm only those flagged hosts with an unauthenticated GET of `/app/rest/server` through the `?jsp=` bypass. It does not create a token or user.
4. Collect the per-host rows: product match, version, affected flag, confirmed flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, affected, confirmed, and errors.

## Inputs

- **Target list.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a `url` field also works. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether TeamCity was detected, the version read, the affected flag, and whether the REST server path answered without credentials.
- **summary.json.** Counts across the list: targets, product hits, affected, confirmed, and errors.

## Integrations

- HTTP. Unauthenticated GET to the product surface and, on flagged hosts only, `/app/rest/server` through the `?jsp=` path. No token write.

## Sample output

The records below are illustrative and do not come from a real run. They show one TeamCity host inside the CVE-2024-27198 range, one patched host, and one host that is not the product.

```jsonl
{"target_url": "https://ci.example.com", "product_detected": true, "version": "2023.11.3", "affected": true, "error": null}
{"target_url": "https://ci.example.org", "product_detected": true, "version": "2023.11.4", "affected": false, "error": null}
{"target_url": "https://shop.example.net", "product_detected": false, "version": null, "affected": false, "error": "not_product"}
```

```json
{"cve": "CVE-2024-27198", "total_targets": 3, "affected": 1, "not_affected": 1, "errors": 1}
```

## FAQ

### Which TeamCity versions does this flag?

TeamCity before 2023.11.4. Backported floors are 2023.05.6, 2022.10.6, and 2022.04.7. The compare uses the version the product itself served.

### Does a confirmed row mean a token was created?

No. Confirm only GETs `/app/rest/server` through the `?jsp=` bypass. It does not create a token or user. A confirmed row means the REST server path still answers without credentials.

### Is this check safe on production?

Yes. Fingerprint is read-only GET. Confirm is an unauthenticated GET of server info, only on hosts already in range. It does not log in or write a token.

### Does the check need credentials?

No. It fingerprints the public page the way an external scanner would.

### What is CVE-2024-27198?

An unhandled path with a jsp query that skips the TeamCity auth filter. CISA listed it on KEV after confirmed use. This workflow flags by version, then confirms REST server info without credentials.

## Related workflows

- [TeamCity Auth Bypass (CVE-2024-27199)](/library/jetbrains-teamcity-auth-bypass-cve-2024-27199). Reach for it when the next flag is the path-traversal sibling, not the jsp query.
- [Jenkins CLI File Read (CVE-2024-23897)](/library/jenkins-path-traversal-check-cve-2024-23897). Reach for it when the next CI host is Jenkins, not TeamCity.
- [Ivanti Auth Bypass (CVE-2023-46805)](/library/ivanti-auth-bypass-check-cve-2023-46805). Reach for it when the next host is a VPN gateway.

---
_Markdown source of https://trickest.com/library/teamcity-auth-bypass-check-cve-2024-27198._