JetBrains TeamCity Critical RCE: Detection and Defense Against Unauthenticated Exploit

JetBrains has issued a critical security advisory regarding a severe authentication bypass vulnerability affecting TeamCity On-Premises. This flaw allows unauthenticated attackers to execute arbitrary code remotely on the underlying server. For organizations relying on TeamCity for CI/CD pipelines, this represents a critical supply chain risk. An attacker exploiting this vulnerability does not merely compromise a web server; they gain the ability to inject malicious code into build artifacts, steal developer credentials, and pivot laterally into the broader production environment. Immediate defensive action is required to secure build infrastructure.

Technical Analysis

Affected Product: JetBrains TeamCity (On-Premises installations only).

Vulnerability Class: Authentication Bypass leading to Remote Code Execution (RCE).

The Threat: The vulnerability exists within the authentication mechanism of the TeamCity web application. Due to a flaw in how the application validates user credentials or session tokens in specific contexts, an attacker can bypass the login requirement entirely. Once past the authentication layer, the attacker can leverage existing functionality (such as build agents or diagnostic tools) to execute system commands.

Attack Chain:

Discovery: Attacker identifies a TeamCity On-Premises instance exposed to the internet.
Bypass: Attacker sends a crafted HTTP request to the endpoint, triggering the authentication bypass.
Execution: Attacker utilizes the API or web interface to trigger a build or server-side action that executes a payload (e.g., PowerShell, Bash).
Objective: The attacker establishes a foothold, dumps secrets, or poisons the software supply chain.

Exploitation Status: JetBrains has flagged this as critical. While proof-of-concept concepts are likely circulating in offensive security circles given the severity, defenders must assume active scanning and exploitation attempts are imminent or underway.

Detection & Response

Detecting this vulnerability requires focusing on the behavior of the exploit (unauthenticated code execution) rather than just the initial HTTP request, which may look like standard traffic to a WAF. Since TeamCity is typically a Java-based application, defenders should hunt for the web server process spawning unexpected shells or child processes.

SIGMA Rules

YAML

---
title: TeamCity Web Server Spawning Shell on Windows
id: 8a4b2c1d-9e3f-4a5b-8c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential RCE via TeamCity by identifying the Java process spawning cmd.exe or powershell.exe.
references:
  - https://www.jetbrains.com/security/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  filter_legit_teamcity:
    CommandLine|contains:
      - 'teamcity-agent'
      - 'buildAgent'
  condition: selection and not filter_legit_teamcity
falsepositives:
  - Legitimate administrative debugging (rare)
level: high
---
title: TeamCity Web Server Spawning Shell on Linux
id: 9c5d3e2f-0f4a-5b6c-9d7e-0f1a2b3c4d5e
status: experimental
description: Detects potential RCE via TeamCity by identifying the Java process spawning /bin/sh or /bin/bash on Linux.
references:
  - https://www.jetbrains.com/security/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentExecutable|endswith:
      - '/java'
      - '/jre/bin/java'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/zsh'
  filter_legit_teamcity:
    CommandLine|contains:
      - 'agent.sh'
      - 'startup.sh'
  condition: selection and not filter_legit_teamcity
falsepositives:
  - Legitimate build agent tasks
level: high

KQL (Microsoft Sentinel / Defender)

KQL — Microsoft Sentinel / Defender

// Hunt for TeamCity parent process spawning suspicious shells
DeviceProcessEvents
| where InitiatingProcessFileName has "java" 
| where ProcessFileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh")
| where not(ProcessCommandLine has_any ("buildAgent", "teamcity-agent", "launcher"))
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessFileName, ProcessCommandLine, AccountName
| order by Timestamp desc

Velociraptor VQL

VQL — Velociraptor

-- Hunt for unexpected child processes of Java (TeamCity Server)
SELECT Pid, Name, CommandLine, Exe, Username, StartTime
FROM pslist()
WHERE Parent.Name =~ 'java'
  AND Name IN ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'bash', 'sh')
  AND NOT CommandLine =~ 'teamcity-agent'

Remediation Script (PowerShell)

PowerShell

# TeamCity On-Premises Version Check Script
# Run this on the TeamCity Server to check build version against known patched versions.

$TeamCityPath = "C:\TeamCity" # Adjust path if installed elsewhere
$ConfigFile = Join-Path -Path $TeamCityPath -ChildPath "conf\build-server.properties"

if (Test-Path $ConfigFile) {
    Write-Host "[+] Detected TeamCity Configuration at: $ConfigFile"
    
    # Attempt to find the installed version from the log or files
    $LogPath = Join-Path -Path $TeamCityPath -ChildPath "logs\teamcity-server.log"
    
    if (Test-Path $LogPath) {
        $LastLines = Get-Content $LogPath -Tail 20
        $VersionInfo = $LastLines | Select-String "TeamCity"
        Write-Host "[+] Last Log Entries Indicating Version:"
        Write-Host $VersionInfo
    }
    
    # Check for the 'teamcity-server.jar' or similar to verify location
    $LibPath = Join-Path -Path $TeamCityPath -ChildPath "lib"
    if (Test-Path $LibPath) {
        Write-Host "[+] TeamCity Library directory found. Please manually verify the 'buildServer.properties' or Admin UI for the exact Build Number."
        Write-Host "[!] If the build number is below the latest patched version from JetBrains, update immediately."
    }
} else {
    Write-Host "[-] TeamCity not found at default path. Please verify installation directory."
}

Remediation

Immediate Patching: Update TeamCity On-Premises to the latest version released by JetBrains that addresses this authentication bypass. This is the only permanent fix.
Network Isolation: If patching is delayed immediately, restrict access to the TeamCity web interface (/app or /admin) via IP allow-listing. Ensure the server is not accessible directly from the public internet.
Credential Audit: Assume that if the instance was exposed, credentials may have been dumped. Force a rotation of all credentials, API tokens, and secrets stored within the TeamCity server.
Log Forensics: Review teamcity-server.log and access.log for requests around the time of the disclosure that resulted in HTTP 200 OK responses from unauthenticated IP addresses accessing administrative endpoints.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub