CVE-2025-26493
📋 TL;DR
Multiple DOM-based cross-site scripting (XSS) vulnerabilities exist in JetBrains TeamCity's Code Inspection Report tab. These allow attackers to inject malicious scripts that execute in users' browsers when viewing manipulated reports. Organizations using vulnerable TeamCity versions are affected.
💻 Affected Systems
- JetBrains TeamCity
📦 What is this software?
Teamcity by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as authenticated users, or redirect users to malicious sites, potentially leading to full TeamCity compromise.
Likely Case
Attackers with access to create or modify code inspection reports could inject scripts that steal session data from users viewing those reports.
If Mitigated
With proper input validation and output encoding, malicious scripts would be neutralized before reaching users' browsers.
🎯 Exploit Status
Exploitation requires ability to create or modify code inspection reports, and victim must view the manipulated report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.12.2
Vendor Advisory: https://www.jetbrains.com/privacy-security/issues-fixed/
Restart Required: Yes
Instructions:
1. Backup TeamCity configuration and data. 2. Download TeamCity 2024.12.2 from JetBrains website. 3. Stop TeamCity service. 4. Install the update following JetBrains upgrade guide. 5. Restart TeamCity service. 6. Verify successful upgrade.
🔧 Temporary Workarounds
Restrict Code Inspection Report Access
allLimit who can create or modify code inspection reports to trusted users only.
Content Security Policy
allImplement strict Content Security Policy headers to mitigate XSS impact.
🧯 If You Can't Patch
- Implement strict access controls on code inspection report creation/modification
- Monitor for suspicious activity in TeamCity audit logs
🔍 How to Verify
Check if Vulnerable:
Check TeamCity version in Administration → Server Administration → Server Health → VersionCheck Version:
Check TeamCity web interface or server logs for version informationVerify Fix Applied:
Confirm version is 2024.12.2 or later in the same location📡 Detection & Monitoring
Log Indicators:
- Unusual code inspection report creation/modification patterns
- Suspicious JavaScript in report data
Network Indicators:
- Unexpected external script loading in TeamCity traffic
SIEM Query:
source="teamcity" AND (event="report_creation" OR event="report_modification") AND user NOT IN [trusted_users]