High Severity Relative Path Traversal in JetBrains TeamCity (CVE‑2024‑27199) Threatens Build Automation Trust
What It Is
JetBrains TeamCity, a widely‑deployed continuous‑integration/continuous‑delivery (CI/CD) server, contains a relative‑path traversal flaw (CVE‑2024‑27199). An attacker who can send a crafted request to the TeamCity web UI may cause the server to resolve arbitrary filesystem paths, enabling limited administrative actions such as reading or overwriting files outside the intended directory.
Exploitability
- No public evidence of active exploitation at the time of writing.
- Proof‑of‑concept code has been referenced in security advisories, indicating the vulnerability is reproducible.
- CVSS v3.1 base score is 7.5 (High), reflecting the potential for privilege escalation and impact on CI/CD pipeline integrity.
Affected Products
- JetBrains TeamCity — all supported versions prior to the vendor‑released patch (see JetBrains security advisory for exact version range).
Why It Matters for Compliance & Audit Readiness
- Vendor‑management controls: The flaw underscores the need to maintain an up‑to‑date vendor risk register and to verify that third‑party tools receive timely security updates.
- Access‑control assurance: Path traversal can bypass intended file‑system boundaries, weakening the segregation of duties that auditors expect for build environments.
- Continuous control monitoring: Detecting anomalous file‑access patterns in TeamCity logs provides defensible evidence that the organization is actively monitoring for misuse, a key requirement in frameworks such as NIST CSF PR.PT‑1 and ISO 27001 A.12.4.1.
Recommended Actions
- Identify the TeamCity version in use and compare against the patched releases.
- Apply the JetBrains security update immediately; if patching cannot be performed, implement a temporary web‑application firewall rule that blocks the vulnerable endpoint.
- Review TeamCity access logs for unexpected path‑traversal attempts (e.g., “../” sequences) and retain evidence for audit trails.
- Update the vendor‑risk register to reflect the new CVE, documenting remediation status and any compensating controls.
- Integrate continuous monitoring of CI/CD tooling into your security operations center (SOC) dashboards to surface similar anomalies in the future.
Source: CISA KEV – CVE‑2024‑27199