CVE-2025-54534
📋 TL;DR
This vulnerability allows reflected cross-site scripting (XSS) attacks on JetBrains TeamCity's agentpushPreset page. Attackers can inject malicious scripts that execute in users' browsers when they visit specially crafted URLs. Organizations running vulnerable TeamCity versions are affected.
💻 Affected Systems
- JetBrains TeamCity
📦 What is this software?
Teamcity by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as authenticated users, or redirect users to malicious sites.
Likely Case
Attackers could steal user session tokens or credentials through phishing links targeting TeamCity users.
If Mitigated
With proper input validation and output encoding, the impact is limited to potential script execution in isolated contexts.
🎯 Exploit Status
Exploitation requires user interaction (clicking malicious link) and access to the vulnerable page.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.07 or later
Vendor Advisory: https://www.jetbrains.com/privacy-security/issues-fixed/
Restart Required: Yes
Instructions:
1. Backup TeamCity configuration and data. 2. Download TeamCity 2025.07 or later from JetBrains website. 3. Stop TeamCity service. 4. Install the updated version. 5. Restart TeamCity service. 6. Verify functionality.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall or proxy rules to filter malicious script patterns in URLs.
Access Restriction
allRestrict access to agentpushPreset page to trusted IP addresses only.
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution sources.
- Educate users about phishing risks and not clicking untrusted TeamCity links.
🔍 How to Verify
Check if Vulnerable:
Check TeamCity version in Administration → Server Administration → Server Health → Version.Check Version:
On TeamCity server: cat /opt/teamcity/version.txt or check web interface.Verify Fix Applied:
Verify version is 2025.07 or later and test agentpushPreset page with safe XSS payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual URL parameters containing script tags or JavaScript in access logs
- Multiple failed access attempts to agentpushPreset with suspicious parameters
Network Indicators:
- HTTP requests to agentpushPreset with encoded script payloads in query parameters
SIEM Query:
source="teamcity_access.log" AND uri="/agentpushPreset" AND (query="<script" OR query="javascript:")