Critical TeamCity Flaw: Why Every CI/CD Pipeline Is Under Attack | Antonio Pedoto
A critical authentication‑bypass bug lets attackers take over TeamCity servers with a single HTTP request – act now.
Hook - The Clock Is Ticking Within hours of discovery, researchers warned that more than 10,000 TeamCity instances could be seized by a single crafted HTTP request. The flaw bypasses authentication, grants admin rights, and opens a back-door for remote code execution. Threat-intel feeds already show scanners probing the internet, confirming that attackers are testing the exploit in the wild. If you run a CI/CD pipeline on TeamCity, every build, secret, and downstream system is at risk.
Why This Vulnerability Is a Massive Risk Critical exposure - CVSS 9.8 places this issue in the critical tier. The bug lives in the REST API token handling, meaning any reachable endpoint can be tricked into believing the request comes from a legitimate administrator. Supply-chain nightmare - Compromise of the CI server lets adversaries inject malicious code into every build, steal cloud credentials, and propagate malware across repositories. A single breach can cascade into a full-scale supply-chain attack affecting downstream services. Narrow patch window - JetBrains has announced a 30-day support deadline. After that date, vulnerable versions will no longer receive security updates, turning a temporary bug into a permanent back-door for any unpatched installation. Active exploitation - Automated scanners are already targeting the /app/rest/... endpoint on ports 8111 and 8080. The low-complexity, one-line curl payload makes the attack accessible to both script kiddies and sophisticated actors.
How the Attack Works (No Deep Technical Jargon) Discovery - The attacker scans the internet for exposed TeamCity servers. Payload delivery - Using a simple curl command, they POST a forged authentication token to the REST API. Bypass - The server treats the request as an authenticated admin. Execution - The attacker triggers the runBuild API to launch a build that runs arbitrary scripts, or they upload a malicious plugin, gaining persistent control.
3 Immediate Actions to Defend Your Environment Apply the official patch immediately - JetBrains released a hot-fix for CVE-2024-XXXXX. Download the update for your specific version (2022.10-2024.1) and apply it within the next 24 hours. Verify the patch status with teamcity-server.sh status or the UI version banner. Revoke and rotate all REST API tokens - After patching, invalidate every existing token, then generate new ones with the principle of least privilege. Store them in a secure vault and restrict their usage to required services only. Restrict network exposure - Move TeamCity behind a VPN or zero-trust gateway, block inbound traffic on ports 8111/8080 from the public internet, and enforce IP-allowlists for CI agents. Enable WAF rules that detect the malformed token pattern used by the exploit.
What to Watch Moving Forward Monitor logs for unusual /app/rest/ POST requests, especially those that result in runBuild calls from unknown IPs. Enable runtime application self-protection (RASP) if your environment supports it, to catch anomalous code execution. Plan for long-term hardening - Review plugin usage, enforce signed plugins only, and adopt immutable infrastructure for build agents.
Want the Full Technical Breakdown? If you need a deep-dive into the exact request structure, proof-of-concept code, and a forensic checklist for compromised servers, stay tuned for our upcoming article: “TeamCity RCE Exploited - Step-by-Step Incident Response”.
---
🔒 Want the complete protection guide?
The deep-dive includes: ✅ Step-by-step security checklist 🔧 Recommended free tools 📋 FAQ with expert answers 🛡️ Best practices for businesses and individuals
[→ Read the Complete Protection Guide]