- Application/component: JetBrains TeamCity
- Affected version: < 2024.07.3
- Score (CVSS 3.1): 7.5 High
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CWEs:CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
- CWE-23: Relative Path Traversal
CVE: CVE-2024-47949
During a more detailed analysis of JetBrains TeamCity, I identified a vulnerability.
Description
TeamCity supports creating backups. To create backups, a user requires the
Change backup settings and control backup process permission.
The backup file must be given a name. The application verifies that the
file name does not contain ../:
Unfortunately, this check can be bypassed, allowing the ZIP file to be written to an arbitrary directory.
Proof of Concept
The operating system is Linux. Backslashes are used instead of forward slashes; in other words, ..\ is used instead of ../:
The file could then be written to an arbitrary directory, such as /temp, as shown in the shell:
Lessons learned
Viewed in isolation, the impact is not severe. Although being able to write to arbitrary directories is always problematic—for example, files could be overwritten, shells could be placed, or sensitive files could be stored where they become accessible—I was unable to escalate this vulnerability further during brief testing. This does not mean that escalation is impossible; it might work when combined with other exploits.
An attacker will always try to bypass checks. Edge cases must also be considered and tested.
In this case, the developer may have been thinking exclusively in terms of Linux, or the check may have used
File.separator without accounting for the fact that Java automatically converts slashes and backslashes
to the appropriate format. For example,
new File("../");
and
new File("..\\");
produce the same result.
Note
All tests were performed on my own local instance (using Docker) and with test user data that I created myself.
JetBrains responded quickly, constructively, and professionally.
Timeline
- Reported to JetBrains on September 13, 2024
- Response received on September 14, 2024
- Issue fixed on September 24, 2024
- Patch released on October 1, 2024
- CVE entry published as CVE-2024-47949 on October 8, 2024
- Blog post released on May 13, 2025