CVE-2025-67740
📋 TL;DR
This vulnerability in JetBrains TeamCity allows improper access control that could expose GitHub App token metadata. It affects organizations using TeamCity CI/CD servers with GitHub App integrations. The exposure is limited to metadata rather than the actual tokens themselves.
💻 Affected Systems
- JetBrains TeamCity
📦 What is this software?
Teamcity by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access GitHub App token metadata, potentially enabling reconnaissance for further attacks or understanding integration patterns.
Likely Case
Unauthorized users within the TeamCity environment could view GitHub App integration details, revealing configuration information.
If Mitigated
With proper access controls and network segmentation, impact is minimal as only metadata exposure occurs.
🎯 Exploit Status
Requires some level of access to the TeamCity instance
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.11 or later
Vendor Advisory: https://www.jetbrains.com/privacy-security/issues-fixed/
Restart Required: Yes
Instructions:
1. Backup TeamCity configuration and data. 2. Download TeamCity 2025.11 or later from JetBrains website. 3. Follow the official upgrade guide for your deployment method (Windows/Linux/Docker). 4. Restart TeamCity services.
🔧 Temporary Workarounds
Restrict GitHub App Access
allTemporarily disable or restrict GitHub App integrations in TeamCity
Navigate to Administration > Integrations > GitHub Apps and review/disable configurations
🧯 If You Can't Patch
- Implement strict network segmentation to isolate TeamCity from untrusted networks
- Review and tighten TeamCity user permissions, limiting who can access integration settings
🔍 How to Verify
Check if Vulnerable:
Check TeamCity version in Administration > Global Settings. If version is below 2025.11 and GitHub Apps are configured, system is vulnerable.Check Version:
Check TeamCity web interface or server logs for version informationVerify Fix Applied:
After upgrade, verify version shows 2025.11 or higher in Administration > Global Settings📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to GitHub App configuration endpoints
- Multiple failed authentication attempts followed by successful access to integration settings
Network Indicators:
- Unusual API calls to GitHub App metadata endpoints from unexpected IPs
SIEM Query:
source="teamcity" AND (uri_path="/app/rest/integrations/github" OR event_description="GitHub App")