CVE-2024-36370
📋 TL;DR
This stored cross-site scripting (XSS) vulnerability in JetBrains TeamCity allows attackers to inject malicious scripts into OAuth connection settings. When administrators view these settings, the scripts execute in their browser context. All TeamCity instances running vulnerable versions are affected.
💻 Affected Systems
- JetBrains TeamCity
📦 What is this software?
Teamcity by Jetbrains
Teamcity by Jetbrains
Teamcity by Jetbrains
Teamcity by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
Administrator account compromise leading to full TeamCity system takeover, data exfiltration, or deployment of malicious builds.
Likely Case
Session hijacking of administrators, credential theft, or unauthorized actions performed with admin privileges.
If Mitigated
Limited impact due to proper input validation and output encoding preventing script execution.
🎯 Exploit Status
Requires authenticated access to TeamCity with permissions to modify OAuth settings.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 or later
Vendor Advisory: https://www.jetbrains.com/privacy-security/issues-fixed/
Restart Required: Yes
Instructions:
1. Backup TeamCity configuration and data. 2. Download patched version from JetBrains website. 3. Stop TeamCity service. 4. Install updated version. 5. Restart TeamCity service. 6. Verify version is updated.
🔧 Temporary Workarounds
Restrict OAuth Settings Access
allLimit permissions to modify OAuth connection settings to trusted administrators only.
Content Security Policy
allImplement strict Content Security Policy headers to mitigate XSS impact.
🧯 If You Can't Patch
- Implement strict access controls on TeamCity administration interface
- Monitor and audit all OAuth connection setting modifications
🔍 How to Verify
Check if Vulnerable:
Check TeamCity version in Administration → Server Administration → Global SettingsCheck Version:
Check TeamCity web interface or server logs for version informationVerify Fix Applied:
Verify version is 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 or later📡 Detection & Monitoring
Log Indicators:
- Unusual modifications to OAuth connection settings
- Multiple failed login attempts followed by OAuth changes
Network Indicators:
- Suspicious requests to OAuth configuration endpoints
- Unexpected external connections from TeamCity server
SIEM Query:
source="teamcity" AND (event="oauth_settings_modified" OR event="configuration_change")