CVE-2024-47949
📋 TL;DR
This CVE describes a path traversal vulnerability in JetBrains TeamCity that allows attackers to write backup files to arbitrary locations on the server. Attackers could potentially overwrite critical system files or deploy malicious content. All TeamCity instances running versions before 2024.07.3 are affected.
💻 Affected Systems
- JetBrains TeamCity
📦 What is this software?
Teamcity by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through overwriting critical system files, installation of persistent backdoors, or denial of service by corrupting essential files.
Likely Case
Unauthorized file writes to TeamCity directories, potentially enabling privilege escalation or data manipulation within the TeamCity environment.
If Mitigated
Limited impact with proper file permission restrictions and network segmentation preventing access to critical system files.
🎯 Exploit Status
Requires authentication to TeamCity to exploit the backup functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.07.3
Vendor Advisory: https://www.jetbrains.com/privacy-security/issues-fixed/
Restart Required: Yes
Instructions:
1. Download TeamCity 2024.07.3 from JetBrains website. 2. Stop the TeamCity service. 3. Backup your current installation. 4. Install the new version. 5. Restart TeamCity service.
🔧 Temporary Workarounds
Restrict backup file locations
allConfigure TeamCity to only allow backup writes to specific, controlled directories
Modify TeamCity configuration to set restricted backup paths
Disable backup functionality
allTemporarily disable TeamCity backup features until patching can be completed
Disable backup-related permissions in TeamCity administration
🧯 If You Can't Patch
- Implement strict file system permissions to prevent TeamCity from writing outside designated directories
- Deploy network segmentation to isolate TeamCity servers from critical infrastructure
🔍 How to Verify
Check if Vulnerable:
Check TeamCity version in Administration → Server Administration → Server Health → VersionCheck Version:
Check TeamCity web interface at Administration → Server Administration → Server HealthVerify Fix Applied:
Verify version is 2024.07.3 or later in the same location📡 Detection & Monitoring
Log Indicators:
- Unusual backup operations
- File write attempts to unexpected locations
- Failed path validation errors
Network Indicators:
- Unusual backup-related API calls
- Suspicious file transfer patterns
SIEM Query:
source="teamcity" AND (event_type="backup" OR file_write) AND path NOT CONTAINS "/expected/backup/path/"