CVE-2024-27198 — SOC Detection & Incident Response Lab

Authentication Bypass in JetBrains TeamCity | CVSS Score: 9.8 (Critical)

This project builds a complete SOC Lab environment to simulate, detect, and respond to CVE-2024-27198 — an authentication bypass vulnerability in JetBrains TeamCity 2023.11.3 using path confusion techniques.

Lab Architecture

Quick Start

cd 1-lab-setup
docker-compose up -d

Attack Chain (MITRE ATT&CK)

Evidence

TeamCity Victim Server (localhost:8111)

[TeamCity Dashboard]

TeamCity 2023.11.3 running as the victim server — confirmed vulnerable version>

Kibana SIEM — SOC Monitor Dashboard

[Kibana SOC Dashboard]

Real-time log monitoring dashboard showing attack activity timeline (June 19, 2026)

Kibana Alert Rule — Enabled & Running

[Kibana Alert Rule]

CVE-2024-27198 Detection Alert rule — Enabled, checking every 1 minute

Repository Structure

.
├── 1-lab-setup/
│   ├── docker-compose.yml      # Full stack: TeamCity + PostgreSQL + ELK
│   ├── logstash.conf           # Log pipeline with suspicious tag detection
│   └── kibana.yml              # Kibana configuration
├── 2-detection/
│   ├── sigma/
│   │   └── cve-2024-27198-detect.yml   # Sigma detection rule (MITRE T1190)
│   └── ids-ips/suricata/
│       └── cve-2024-27198.rules        # Suricata IDS rules (3 rules)
├── 3-incident-response/
│   ├── playbook/
│   │   └── SOC-Playbook.md             # Triage → Containment → Eradication
│   └── containment/
│       └── block-ip.sh                 # Auto IP blocking script
└── 4-evidence/
    └── screenshots/                    # Attack evidence (5 screenshots)

Detection Coverage

Sigma Rule

Detects path confusion patterns (?jsp=, ;.jsp) targeting TeamCity REST API endpoints with HTTP 200 responses.

Suricata IDS Rules

Logstash Pipeline

Automatically tags logs containing ;, .jsp, or jsp= as suspicious and forwards to Elasticsearch index teamcity-logs-*.

Incident Response Playbook

See 3-incident-response/playbook/SOC-Playbook.md

References

• NVD — CVE-2024-27198
• Rapid7 Analysis
• MITRE ATT&CK T1190