The sonar blog post on the exploit explains it well. https://www.sonarsource.com/blog/teamcity-vulnerability/ https://www.sonarsource.com/blog/teamcity-vulnera

The sonar blog post on the exploit explains it well. https://www.sonarsource.com/blog/teamcity-vulnerability/ https://www.sonarsource.com/blog/teamcity-vulnerability/ The middleware was not checking paths if they ended with /rpc2, and incidentally there was an endpoint to create named tokens for any user. So they created tokens named rpc2, which is an indicator of compromise.