CVE-2025-52876
📋 TL;DR
This vulnerability allows reflected cross-site scripting (XSS) attacks on the favoriteIcon page in JetBrains TeamCity. Attackers can inject malicious scripts that execute in users' browsers when they visit a specially crafted URL. This affects all TeamCity administrators and users who access the vulnerable page.
💻 Affected Systems
- JetBrains TeamCity
📦 What is this software?
Teamcity by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, or redirect users to malicious sites, potentially leading to full account compromise.
Likely Case
Attackers could steal session tokens or perform limited actions in the context of the victim's session, but full system compromise is unlikely without additional vulnerabilities.
If Mitigated
With proper input validation and output encoding, the impact is limited to minor UI manipulation or information disclosure.
🎯 Exploit Status
Exploitation requires user interaction (clicking a malicious link) and authentication to TeamCity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.03.3 or later
Vendor Advisory: https://www.jetbrains.com/privacy-security/issues-fixed/
Restart Required: Yes
Instructions:
1. Backup your TeamCity installation and database. 2. Download TeamCity 2025.03.3 or later from the JetBrains website. 3. Follow the official upgrade guide for your deployment method (Windows/Linux/Docker). 4. Restart the TeamCity service after installation.
🔧 Temporary Workarounds
Input Validation Filter
allImplement a web application firewall or reverse proxy rule to filter malicious input targeting the favoriteIcon endpoint.
🧯 If You Can't Patch
- Restrict access to TeamCity to trusted networks only using firewall rules.
- Implement Content Security Policy (CSP) headers to mitigate XSS impact.
🔍 How to Verify
Check if Vulnerable:
Check your TeamCity version in the administration interface under 'Administration > Global Settings'.Check Version:
On TeamCity server: cat /opt/teamcity/version.txt or check web interface.Verify Fix Applied:
Verify the version is 2025.03.3 or higher and test the favoriteIcon functionality with safe input.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /favoriteIcon endpoint with script tags or encoded payloads
- Multiple failed authentication attempts followed by XSS payloads
Network Indicators:
- HTTP requests containing script tags or JavaScript in URL parameters to TeamCity
SIEM Query:
source="teamcity" AND (url="*favoriteIcon*" AND (param="*<script>*" OR param="*javascript:*"))