CVE-2025-68164
📋 TL;DR
This vulnerability in JetBrains TeamCity allows attackers to enumerate open ports on the server when testing Perforce connections. It affects organizations using TeamCity with Perforce integration. The impact is limited to information disclosure about network services.
💻 Affected Systems
- JetBrains TeamCity
📦 What is this software?
Teamcity by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
An attacker could map all open ports on the TeamCity server, potentially identifying other vulnerable services for further exploitation.
Likely Case
Limited information disclosure revealing which ports are open on the TeamCity server, which could aid in reconnaissance for other attacks.
If Mitigated
Minimal impact as port information alone doesn't grant access, though it could help attackers plan further attacks.
🎯 Exploit Status
Requires access to TeamCity interface with permissions to test Perforce connections
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.11 or later
Vendor Advisory: https://www.jetbrains.com/privacy-security/issues-fixed/
Restart Required: Yes
Instructions:
1. Backup TeamCity configuration and data. 2. Download TeamCity 2025.11 or later from JetBrains website. 3. Stop TeamCity service. 4. Install the new version following JetBrains upgrade guide. 5. Restart TeamCity service.
🔧 Temporary Workarounds
Disable Perforce Integration
allRemove or disable Perforce VCS roots and connection tests if not required
Restrict Access to VCS Configuration
allLimit permissions for users who can configure or test VCS connections
🧯 If You Can't Patch
- Implement network segmentation to isolate TeamCity server from sensitive systems
- Monitor for unusual port scanning activity from TeamCity server IP addresses
🔍 How to Verify
Check if Vulnerable:
Check TeamCity version in Administration → Server Administration → Server Health → VersionCheck Version:
Check TeamCity web interface or server logs for version informationVerify Fix Applied:
Confirm version is 2025.11 or later in Administration → Server Administration → Server Health → Version📡 Detection & Monitoring
Log Indicators:
- Multiple failed Perforce connection attempts from single source
- Unusual port scanning patterns from TeamCity server
Network Indicators:
- Unexpected outbound connections from TeamCity server to multiple ports
- Port scanning traffic originating from TeamCity server
SIEM Query:
source="teamcity.log" AND ("Perforce test" OR "port scan" OR "connection test")