Rapid7 Labs medium experimental sigma

CVE-2024-27198 Jetbrains TeamCity authentication bypass

Detects suspicious HTTP(S) GET or POST requests based on specific regular expressions that detect possible authentication bypass attempts towards a Jetbrains TeamCity server

View Source

Detection Logic

{
  "selection1": {
    "http_method": [
      "GET",
      "POST"
    ]
  },
  "selection2": {
    "url
| re": ";\\S*\\.jsp\\?\\S*jsp="
  },
  "selection3": {
    "url
| re": "/\\S*\\?\\S*jsp=\\S*;\\.jsp"
  },
  "condition": "selection1 and (selection2 or selection3)"
}

False Positives

⚠ Legitimate requests that accidentally match the regular expressions.

Field Validations

Loading…

Comments (0)

Loading comments...