Hackers exploit latest TeamCity vulnerability to successfully create administrator accounts

TeamCity is a universal CI/CD software platform that enables flexible workflows, collaboration, and development practices. TeamCity provides a series of features that allow teams to quickly achieve continuous integration: IDE tool integration, various message notifications, various reports, project management, distributed builds, and more.

Recently, hackers have been exploiting a critical authentication bypass vulnerability (CVE-2024-27198) in recently disclosed on-premise versions of TeamCity on a large scale. JetBrains fixed these vulnerabilities in the 2023.11.4 update, but researchers warn that users running unpatched instances could be compromised.

LeakIX, a search engine that exposes device misconfigurations and vulnerabilities, stated that when scanning compromised TeamCity servers, it observed 1,711 vulnerable instances, of which "1,442 show clear signs of rogue user creation. If you were or are still running a vulnerable system, please assume compromise and take mitigation measures as soon as possible."

Based on the detailed description of the vulnerability and the corresponding public exploits showing a complete server takeover strategy after gaining server administrative privileges, researchers warned earlier this week that the TeamCity CVE-2024-27198 vulnerability would be exploited immediately.

It is reported that an undisclosed financial and insurance sector organization's TeamCity was attacked by this exploit, which was used to gain initial access and move laterally to other systems. Pyxsoft Security Lab learned that: "After gaining initial access, the attacker created an administrator account, planted a PowerShell script, and deployed an unidentified malware."

The attacker created a "TeamCityService" account on a publicly accessible TeamCity instance. In TeamCity's software build environment, the attacker planted the unsigned SysUpdate.exe executable in the C: directory via winpty-agent.exe.

After establishing a foothold, the attacker planned to schedule SysUpdate.exe to run in the build environment every day at 10:00 AM, and created an "Administrator" user, adding it to 24 groups. Subsequently, the attacker deleted the web.ps1 PowerShell script, but its execution went undetected.

The attacker then planted the same malicious executable into another build environment of the compromised organization, but no further malicious activity from the "Administrator" account has been observed since.

This unsigned SysUpdate.exe is elusive; the attacker extracted the keys of local security mechanisms and repeatedly changed the password of the local administrator account. LSA secrets contain various passwords, including user credentials, service accounts, Internet Explorer, RAS connections, SQL, system accounts, and private user data (such as Encrypting File System encryption keys).

Pyxsoft Security Lab has also observed active attacks or attack attempts targeting multiple destinations.

JetBrains originally announced the release of TeamCity 2023.11.4, which addresses both vulnerabilities, in a short blog post, with the company stating: "We will not disclose detailed information on security-related issues to avoid compromise of customers who continue to use previous bug fixes and/or major versions of TeamCity."

But Rapid7, which discovered the vulnerability, published a detailed technical advisory on Monday in accordance with its vulnerability disclosure policy. The advisory included a POC demonstrating the TeamCity exploit, forcing JetBrains to publish a second blog post disclosing the severity of the issue and the consequences of exploiting it.

Hours after Rapid7's release, several other POC exploit codes for CVE-2024-27198 – POC 1, POC 2, and POC 3 – were published on GitHub, forcing researchers to question Rapid7's earlier full POC release. One of the POCs, if successful, adds a new administrator user, while the other two execute remote code execution and also include the functionality to add an administrator user.

Due to the availability of many different POCs publicly and the surge in the number of exploit attempts, JetBrains and researchers advise customers to apply the TeamCity upgrade as soon as possible.

Attack simulation rules targeting this exploit have been added to the Pyxsoft Security Measure Verification Platform. If you are also using TeamCity in your environment, you can search for the keywords "TeamCity" or "CVE-2024-27198" in the Pyxsoft Security Measure Verification Platform to obtain relevant attack simulation verification actions, thereby verifying whether your security defense system can effectively respond to the vulnerability. The platform ensures your verification process is safe and harmless in an industry-unique manner.