# AI-Driven Red-Team Chain Against AWS CI/CD: TeamCity CVE-2024-27198 Auth Bypass to IMDS Credential Theft and Cloud Pivot (ProjectDiscovery Neo)

> ProjectDiscovery documents an autonomous AI red-team engagement (Neo) in a simulated AWS lab: a JetBrains TeamCity 2023.11.2 authentication bypass (CVE-2024-27198), EC2 IMDSv1 credential theft, forged-token reuse, IAM/S3/SSM enumeration, and private-subnet lateral movement via a build agent. The post is a controlled methodology demonstration, not a report of in-the-wild exploitation of this exact chain — though CVE-2024-27198 itself has been mass-exploited since March 2024 and sits in the CISA KEV catalog.

- **Published:** 2026-10-31T00:48:23Z
- **Last reviewed:** 2026-10-31T00:48:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4869
- **ID:** TL-2026-4869
- **Severity:** HIGH (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-27198, CVE-2024-27199

## Description

On 2026-05-21, ProjectDiscovery (author Prince Chaddha) published a walkthrough of its autonomous AI red-team agent, Neo, compromising a simulated AWS environment end to end in roughly 2.5 hours with no human intervention between phases. The initial target was a JetBrains TeamCity On-Premises 2023.11.2 (build 147486) server exposed on port 8111 and left unpatched against CVE-2024-27198. Neo reached superadmin access in approximately 82 seconds.

CVE-2024-27198 (CVSS 3.1 9.8, CWE-288, reported by Rapid7 on 2024-02-20 and patched by JetBrains in 2023.11.4 on 2024-03-04) is an alternative-path authentication bypass. Per Rapid7's technical disclosure, the flaw lives in the BaseController class of web-openapi.jar, specifically updateViewIfRequestHasJspParameter: a request that (1) targets a non-existent resource returning HTTP 404, (2) carries a query parameter named jsp holding an authenticated API path, and (3) appends a path-parameter segment ending in `.jsp`, is routed to the authenticated path without a session. The canonical fingerprinting request is `GET /hax?jsp=/app/rest/server;.jsp`. A companion flaw, CVE-2024-27199 (CVSS 7.3), achieves a similar effect through classic `../` path traversal under prefixes such as `/res/`, `/update/`, and `/.well-known/acme-challenge/` (e.g. `/res/../admin/diagnostic.jsp`), and can be used to overwrite the HTTPS certificate or leak diagnostic data.

In the Neo engagement, the agent used the `jsp` bypass to mint a persistent superadmin API token (`POST /hax?jsp=/app/rest/users/id:1/tokens/{tokenName};.jsp`) that survived server restarts, then read a project's build configuration parameters (`GET /app/rest/projects/id:{projectId}/parameters;.jsp`) and recovered a production database connection string with a plaintext password, a base64-encoded SSH deploy key, a JWT signing secret, and a live third-party payment API key — all stored in plaintext inside TeamCity build configuration.

Because the TeamCity host still had IMDSv1 enabled, Neo created a new build step that queried the EC2 Instance Metadata Service (link-local address 169.254.169.254) and obtained short-lived AWS STS credentials tied to an over-permissioned CI/CD IAM role (S3 read, SSM Parameter Store read, EC2 describe, RDS describe) valid for more than five hours. With those credentials it pulled a compressed SQL database backup containing roughly 1,000 customer PII records (names, emails, phone numbers, partial SSNs, partial card numbers, subscription tier, MRR) from one S3 bucket, found a legacy, un-migrated 2022 configuration file in a build-artifacts bucket containing static long-term AWS access keys plus a monitoring-platform API key and a chat-webhook URL, and enumerated multiple SSM Parameter Store entries (database password, JWT secret duplicate, payment API key, email-provider key, incident-paging key, an internal API hostname, and an RDS endpoint).

Neo then used the previously extracted JWT signing secret to forge an admin-role bearer token offline and executed an arbitrary bash build step from the CI agent to reach a private-subnet internal REST API on port 5000 that had no public IP and relied on network placement rather than authentication for protection. The forged token was accepted by an unauthenticated `/admin` endpoint, exposing an employee roster with salaries, production database connection details, and a confirmed customer count of 847,295 records. A separate `/api/v1/orders` endpoint concatenated the JWT `sub` claim directly into a SQL query (confirmed via an error message leaking the query structure) but was not exploited further because database access was already established through other means. Finally, Neo located a TeamCity internal.properties flag (`rest.debug.database.allow.query.prefixes=select`) enabling an undocumented debug SQL endpoint and used the earlier admin token to run a SELECT against the TeamCity users table, extracting bcrypt-hashed credentials for three accounts; the hashes used an outdated, weak cost factor but were not cracked during the engagement.

The findings illustrate a now-familiar real-world pattern: CVE-2024-27198 and CVE-2024-27199 were mass-exploited beginning around 2024-03-06, with signs of rogue administrative user creation observed across roughly 1,400 internet-facing TeamCity instances within days of disclosure, prompting CISA to add CVE-2024-27198 to the Known Exploited Vulnerabilities catalog on 2024-03-07. Separately reported real-world post-exploitation on compromised TeamCity servers (via this and the related CVE-2023-42793) has included rogue admin account creation, deployment of the open-source Jasmin ransomware and the BianLian ransomware group's extortion operations, XMRig cryptomining, the SparkRAT remote access tool, and Cobalt Strike beacons — none of which were part of the ProjectDiscovery lab engagement itself, but which establish the real blast radius of leaving this CVE unpatched.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1098 Account Manipulation
- T1136.001 Create Account: Local Account
- T1078.004 Valid Accounts: Cloud Accounts
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1552.001 Unsecured Credentials: Credentials In Files
- T1606 Forge Web Credentials
- T1550 Use Alternate Authentication Material
- T1580 Cloud Infrastructure Discovery
- T1087.004 Account Discovery: Cloud Account
- T1046 Network Service Discovery
- T1021 Remote Services
- T1530 Data from Cloud Storage

## Sources

- [Red-Teaming Cloud Infrastructure with Neo (Prince Chaddha, ProjectDiscovery)](https://projectdiscovery.io/blog/red-teaming-cloud-infrastructure-with-neo)
- [ETR: CVE-2024-27198 and CVE-2024-27199 JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities (Fixed)](https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/)
- [JetBrains Security Issues Fixed / TeamCity Advisory](https://www.jetbrains.com/privacy-security/issues-fixed/)
- [NVD - CVE-2024-27198 Detail](https://nvd.nist.gov/vuln/detail/CVE-2024-27198)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2024-27198](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27198)
- [Critical JetBrains TeamCity On-Premises Vulnerability Under Mass Exploitation](https://thehackernews.com/2024/03/critical-jetbrains-teamcity-on-premises.html)
- [Recent TeamCity Vulnerability Exploited in Ransomware Attacks](https://www.securityweek.com/recent-teamcity-vulnerability-exploited-in-ransomware-attacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4869