JetBrains TeamCity On-Premises CVE-2024-27198 (authentication bypass allowing admin actions, mass-exploited, CISA KEV) and CVE-2024-27199: which version fixes it and how do I check my build server for rogue admin accounts?

What it is: In March 2024 JetBrains disclosed two flaws in TeamCity On-Premises found by Rapid7: CVE-2024-27198, a critical authentication bypass that lets an unauthenticated attacker perform admin actions (create admin users, generate access tokens, and from there run code on the server and build agents), and CVE-2024-27199, a path traversal allowing limited unauthenticated changes. Technical details were published within a day, mass exploitation followed with attackers creating rogue admin accounts, and CISA added CVE-2024-27198 to the Known Exploited Vulnerabilities catalog. A compromised CI server exposes source code, signing keys and deployment credentials, so supply-chain impact is serious. Am I affected: - All TeamCity On-Premises versions before 2023.11.4 (TeamCity Cloud was patched by JetBrains). - Check: the version in the footer of the TeamCity web UI or under Administration > Server Administration > Diagnostics. Fix: 1. Upgrade to 2023.11.4 or later (preferably the current release) via the built-in update or a fresh download. JetBrains also released a security patch plugin for servers that couldn't upgrade right away; treat it as a stopgap. 2. If the server is reachable from the internet and you can't patch immediately, make it unreachable until you do, as JetBrains advised. 3. Check for compromise: in Administration > Users, look for administrator accounts you don't recognize (often random-looking names) and recently created users; review access tokens, newly installed plugins, and the audit log for user and token creation you didn't do; check build agents for unexpected processes. 4. If anything is found: remove rogue users and tokens, rebuild the server and agents from clean images, and rotate every secret TeamCity held (VCS credentials, deploy keys, cloud credentials, signing keys, parameters marked as passwords). Review recent builds and artifacts for tampering. Verify: the server reports 2023.11.4 or later, the user list contains only known accounts, and old tokens and credentials no longer work. Sources: https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/ https://www.jetbrains.com/privacy-security/issues-fixed/ https://nvd.nist.gov/vuln/detail/CVE-2024-27198 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27198