CVE-2022-24335: 
JetBrains TeamCity vulnerability analysis and mitigation

JetBrains TeamCity before 2021.2 was affected by a Time-of-check/Time-of-use (TOCTOU) race-condition vulnerability during agent registration via XML-RPC (CVE-2022-24335). The vulnerability was discovered and disclosed in early 2022, affecting the TeamCity continuous integration and deployment server (MITRE CVE).

The vulnerability is related to a race condition that occurs during the agent registration process when using XML-RPC in TeamCity. This type of vulnerability, known as Time-of-check/Time-of-use (TOCTOU), could potentially be exploited during the agent registration workflow (JetBrains Issues).

The TOCTOU vulnerability in the agent registration process could potentially allow attackers to manipulate the timing between the checking and usage of resources, which might lead to unauthorized agent registrations or potential security bypasses in TeamCity environments (MITRE CVE).

The vulnerability was patched in TeamCity version 2021.2. Organizations running affected versions should upgrade to TeamCity 2021.2 or later to mitigate this security risk (JetBrains Issues).