Rapid7 Labs high experimental sigma

Detection of Path Traversal Attacks on JetBrains TeamCity CVE-2024-27199

Detects potential path traversal attacks exploiting specific vulnerable paths to access sensitive endpoints without authentication.

View Source

Detection Logic

{
  "detection": {
    "section1": {
      "c-uri
| contains": [
        "/res/../",
        "/update/../",
        "/.well-known/acme-challenge/../"
      ]
    },
    "section2": {
      "c-uri
| contains": [
        "/admin/diagnostic.jsp",
        "/app/availableRunners",
        "/app/https/settings/setPort",
        "/app/https/settings/certificateInfo",
        "/app/https/settings/defaultHttpsPort",
        "/app/https/settings/fetchFromAcme",
        "/app/https/settings/removeCertificate",
        "/app/https/settings/uploadCertificate",
        "/app/https/settings/termsOfService",
        "/app/https/settings/triggerAcmeChallenge",
        "/app/https/settings/cancelAcmeChallenge",
        "/app/https/settings/getAcmeOrder",
        "/app/https/settings/setRedirectStrategy",
        "/app/pipeline",
        "/app/oauth/space/createBuild.html"
      ]
    },
    "condition": "section1 and section2"
  }
}

False Positives

  • ⚠ Legitimate administrative access to the vulnerable endpoints (ensure proper whitelisting or contextual analysis)

Field Validations

Loading…

Comments (0)

Loading comments...