JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution

JetBrains TeamCity 2026.1.3, 2025.11.7 contains a remote code execution caused by unsafe XStream deserialization in the unauthenticated agent polling protocol. The XStream instance serving /app/agents/v1 is created without NoTypePermission.NONE, so XStream's default type permissions Throwable, Ma...

RCity-CVE-2024-27198

RCity - CVE-2024-27198 RCE & Admin Account Creation & CVE-2024-27199 Auth Bypass Exploiting CVE-2024-27198 & CVE-2024-27199 RCity is a Python script that interacts with a vulnerable TeamCity server. The CVE facilitates for unauthorised admin account creation, bypassing 403's on the domain. Whilst...

CVE-2022-24342

CVE-2022-24342 JetBrains TeamCity - account takeover via CSRF in GitHub authentication PoC CVE-2022-24342 Requirements Usage How does it work? GitHub OAuth2: query parameters processing order CVE-2022-24342: HTTP requests flow Requirements JetBrains TeamCity If you run the exploit on the local...

CVE-2023-42793

CVE-2023-42793 description A security vulnerability in JetBrains TeamCity allows an attacker to create a new user given by the attacker with administrative privileges. Usage example ./cve-2023-42793 http://teamcity.examplewebsite.com username password...

JetBrains TeamCity > 2023.11.3 - Authentication Bypass

In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible id: CVE-2024-23917 info: name: JetBrains TeamCity 2023.11.3 - Authentication Bypass author: iamnoooob,rootxharsh,pdresearch severity: critical description: | In JetBrains TeamCity before 2023.11.3...

CVE-2024-27198-RCE

Cyberspace Mapping Dork Fofa root@kitploit: app="JETBRAINS-TeamCity" ZoomEye root@kitploit: app:"JetBrains TeamCity" Hunter.how root@kitploit: product.name="TeamCity" Shodan root@kitploit: http.component:"teamcity" How to use I'm using Python3.9. root@kitploit: pip install requests urllib3 faker...

pentest_teamcity

使用 Metasploit 对 TeamCity 进行渗透测试 TL;DR: 从JetBrains IDE（例如 IntelliJ 或 PyCharm）获取密码，然后在 TeamCity 持续集成服务器 中使用这些凭据，以利用 metasploit 在服务器和构建代理上获取 meterpreter 会话——作者 Kacper Szurek。 JetBrains 评论 以下是来自供应商（JetBrains TeamCity 团队）的评论，由 Yegor Yarko 提供： 本文的大部分内容描述了恶意用户如何在获得合理权限的情况下滥用 TeamCity。...

CVE-2026-63077

Ejecución remota de código no autenticada en JetBrains TeamCity CVE-2026-63077 Descripción general Este es un script de prueba de concepto para el CVE-2026-63077. Las organizaciones pueden utilizar este script para validar su postura de detección y remediación. Para un análisis técnico completo d...

CVE-2022-25262

CVE-2022-25262 PoC + vulnerability details for CVE-2022-25262 | JetBrains Hub single-click SAML response takeover CVE-2022-25262 Requirements Usage How does it work? Authorization code pool for "OAuth2 - SAML" exchange YouTrack Konnector OAuth2 authorization code takeover by design Mitigation...

CVE-2023-42793

CVE-2023-42793 JetBrains TeamCity before 2023.05.4 is vulnerable to authentication bypass leading to RCE Usage To get a reverse shell root@kitploit: python3 exploit.py References https://blog.jetbrains.com/teamcity/2023/09/cve-2023-42793-vulnerability-post-mortem/...

CVE-2022-25260

CVE-2022-25260 JetBrains Hub pre-auth semi-blind server-side request forgery SSRF Requirements JetBrains Hub 2021.1.14276 JetBrains Hub before 2021.1.14276 was vulneable to improper access control CVE-2022-34894, which allows an attacker create untrusted services without authentication even if...

CVE-2024-27198

CVE-2024-27198 In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions in TeamCity server, an attacker can take full control over all TeamCity projects, builds, agents and artifacts, finally the attacker will perfomn a RCE. Download root@kitploit: git clone...

CVE-2024-27198-RCE

Cyberspace Mapping Dork Fofa root@kitploit: app="JETBRAINS-TeamCity" ZoomEye root@kitploit: app:"JetBrains TeamCity" Hunter.how root@kitploit: product.name="TeamCity" Shodan root@kitploit: http.component:"teamcity" How to use I'm using Python3.9. root@kitploit: pip install requests urllib3...

CVE-2023-42793

Exploit de TeamCity CVE-2023-42793 Este script de Python explota una vulnerabilidad de seguridad CVE-2023-42793 en JetBrains TeamCity, lo que permite a un atacante crear un nuevo usuario con privilegios administrativos. Uso El script acepta como entrada una única URL de instancia de TeamCity o un...

Explora-o-RCE-n-o-autenticado-JetBrains-TeamCity-CVE-2024-27198-

Unauthenticated RCE Exploitation JetBrains TeamCity CVE-2024-27198- In February 2024, two new vulnerabilities were identified affecting the JetBrains TeamCity server CVE-2024-27198 and CVE-2024-27199...

CVE-2024-27198-SOC-Lab

CVE-2024-27198 — SOC Detection & Incident Response Lab Authentication Bypass in JetBrains TeamCity | CVSS Score: 9.8 Critical This project builds a complete SOC Lab environment to simulate, detect, and respond to CVE-2024-27198 — an authentication bypass vulnerability in JetBrains TeamCity...

JetBrains TeamCity < 2023.05.4 - Remote Code Execution

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible id: CVE-2023-42793 info: name: JetBrains TeamCity 2023.05.4 - Remote Code Execution author: iamnoooob,rootxharsh,pdresearch severity: critical description: | In JetBrains TeamCity before...

CVE-2024-27198-RCE

Cyberspace Mapping Dork Fofa root@kitploit: app="JETBRAINS-TeamCity" ZoomEye root@kitploit: app:"JetBrains TeamCity" Hunter.how root@kitploit: product.name="TeamCity" Shodan root@kitploit: http.component:"teamcity" How to use I'm using Python3.9. root@kitploit: pip install requests urllib3 faker ...

CVE-2024-27198-POC

CVE-2024-27198 – JetBrains TeamCity 身份验证绕过与远程代码执行PoC 作者： EynaExp 范围： 仅供研究 / 防御验证 / 授权测试 概述 本仓库包含一个概念验证型批量扫描器 ，针对受 CVE-2024-27198 影响的 JetBrains TeamCity 实例。该漏洞为一个身份验证绕过漏洞，可能导致完全的管理员权限接管和远程代码执行（RCE）。 该工具旨在检测存在漏洞的 TeamCity 服务器 ，验证管理访问权限，并可选择根据服务器版本和配置，使用多种技术验证远程命令执行（RCE） 。 支持多线程扫描 、可选代理 以及结构化输出日志 。 ...

CVE-2022-24442

CVE-2022-24442: FreeMarker Server-Side Template Injection in JetBrains YouTrack By inserting malicious content in the Notification FTL files, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage FreeMarker exposed objects to bypass restrictions and obtain RCE...