CVE-2025-68166
📋 TL;DR
This DOM-based cross-site scripting (XSS) vulnerability in JetBrains TeamCity allows attackers to inject malicious scripts into the OAuth connections tab. When exploited, it could enable session hijacking, credential theft, or unauthorized actions within authenticated sessions. Organizations running vulnerable TeamCity instances are affected.
💻 Affected Systems
- JetBrains TeamCity
📦 What is this software?
Teamcity by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, compromise the entire TeamCity instance, and pivot to internal systems or source code repositories.
Likely Case
Attackers could hijack user sessions, perform unauthorized actions within TeamCity, or steal sensitive build configuration data.
If Mitigated
With proper network segmentation and access controls, impact would be limited to the TeamCity application itself.
🎯 Exploit Status
Exploitation requires authenticated access to the OAuth connections tab and user interaction with malicious payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.11 or later
Vendor Advisory: https://www.jetbrains.com/privacy-security/issues-fixed/
Restart Required: Yes
Instructions:
1. Backup TeamCity configuration and data. 2. Download TeamCity 2025.11 or later from JetBrains website. 3. Follow the official TeamCity upgrade guide. 4. Restart TeamCity services.
🔧 Temporary Workarounds
Restrict OAuth Connections Tab Access
allLimit access to the vulnerable OAuth connections tab to essential administrators only.
Implement Content Security Policy
allAdd strict CSP headers to mitigate XSS impact.
🧯 If You Can't Patch
- Implement strict network access controls to limit TeamCity exposure
- Enable audit logging for all OAuth connection tab activities
🔍 How to Verify
Check if Vulnerable:
Check TeamCity version in Administration → Server Administration → Server Health → VersionCheck Version:
Check TeamCity web interface or server logs for version informationVerify Fix Applied:
Verify version is 2025.11 or later in the same location📡 Detection & Monitoring
Log Indicators:
- Unusual OAuth configuration changes
- Multiple failed authentication attempts to OAuth endpoints
Network Indicators:
- Suspicious JavaScript payloads in HTTP requests to OAuth endpoints
SIEM Query:
source="teamcity" AND (event="oauth_config_change" OR event="admin_action")