CVE-2025-54536
📋 TL;DR
This Cross-Site Request Forgery (CSRF) vulnerability in JetBrains TeamCity allows attackers to trick authenticated users into performing unintended GraphQL operations. Attackers could modify data or perform actions on behalf of users. All TeamCity instances before version 2025.07 are affected.
💻 Affected Systems
- JetBrains TeamCity
📦 What is this software?
Teamcity by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
Attackers could modify user permissions, delete projects, or alter build configurations through forged GraphQL requests executed by authenticated administrators.
Likely Case
Attackers could trick users into changing their own settings, modifying build configurations they have access to, or performing other GraphQL operations within their permission scope.
If Mitigated
With proper CSRF protections or when exploited against low-privilege users, impact is limited to actions within the user's existing permissions.
🎯 Exploit Status
CSRF attacks are well-understood and relatively easy to implement once the vulnerable endpoint is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.07
Vendor Advisory: https://www.jetbrains.com/privacy-security/issues-fixed/
Restart Required: Yes
Instructions:
1. Backup TeamCity configuration and data. 2. Download TeamCity 2025.07 or later from JetBrains website. 3. Stop TeamCity service. 4. Install the new version following JetBrains upgrade guide. 5. Restart TeamCity service.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd custom CSRF protection to GraphQL endpoints using anti-CSRF tokens
Restrict GraphQL Access
allLimit GraphQL endpoint access through network controls or web application firewalls
🧯 If You Can't Patch
- Implement strict SameSite cookie policies and require additional authentication for sensitive GraphQL operations
- Deploy web application firewall with CSRF protection rules and monitor for suspicious GraphQL requests
🔍 How to Verify
Check if Vulnerable:
Check TeamCity version in Administration → Server Administration → Global Settings. If version is below 2025.07, system is vulnerable.Check Version:
Check TeamCity web interface at Administration → Server Administration → Global SettingsVerify Fix Applied:
After upgrade, verify version shows 2025.07 or higher in Administration → Server Administration → Global Settings.📡 Detection & Monitoring
Log Indicators:
- Unusual GraphQL requests from unexpected referrers
- Multiple failed GraphQL operations from same user session
Network Indicators:
- GraphQL POST requests without expected CSRF tokens
- Requests with mismatched Origin/Referer headers
SIEM Query:
source="teamcity.log" AND ("GraphQL" AND "POST") AND NOT referer="*teamcity*"