Is there any way to find out if CVE-2024-23917 has been exploited?

The vulnerability allows an attacker to perform an auth bypass, meaning that an attacker could use this to then alter the server's config granting them a more permanent access. Please run the following checks, as the presence of those entities could be a sign of an attack:

There are no unknown internal properties under Administration - Diagnostics, or in the internal.properties file in the data directory. 
There are no unknown plugins, can be verified both in the UI’s Administration - plugin list as well as in the data directory, plugins subfolder   
There are no unknown tools, can be verified both in the UI’s Administration - Tools as well as in the data directory, plugins/.tools subfolder
Projects and/or build configurations that the attacker could have created
Any additional unknown users that might have been created
Known users, particularly admin users don’t have unknown tokens. This was one of the most common approaches for attacks, so removing all tokens and recreating those you might use would be ideal.
The teamcity-activities.log can contain information of some of the scripts and commands run by attackers.
The audit feature (under Administration - Audit) can contain information about certain actions happening on the server. It should contain information on project and user changes, so you can use it to identify possible changes performed by the attacker.

If you believe your server has been compromised, please don't hesitate to send us a request via the Submit a request button on the top of the page, and consider the possibility of hiring a cyber security forensics specialist to dig deeper into your personal setup and try to identify issues.