JetBrains TeamCity Authentication Bypass Remote Code Execution (CVE-2024-50603)

CVE-2024-50603 allows unauthenticated attackers to bypass authentication on JetBrains TeamCity CI/CD servers and create admin accounts or trigger builds that execute arbitrary commands on Linux build agents.

Affected TeamCity

• TeamCity before 2024.07.3
• Internet-facing CI on ports 8111/443
• Self-hosted build farms with secrets in environment variables

Check exposure

curl -s http://ci.example:8111/login.html | grep -i teamcity
grep -R 'version=' /opt/teamcity/Build/conf/teamcity-startup.properties

Fix

• Upgrade to TeamCity 2024.07.3 or newer
• Require VPN or SSO in front of the CI web UI
• Rotate all API tokens, cloud keys, and deploy credentials on agents
• Review build history for rogue admin users and unexpected shell build steps

CI servers are crown jewels — assume compromise if unpatched and internet reachable.