CVE-2023-41248 in TeamCity
Summary
by MITRE • 08/25/2023
In JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configuration
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/20/2023
JetBrains TeamCity versions prior to 2023.05.3 contained a stored cross-site scripting vulnerability that could be exploited during the configuration of Cloud Profiles. This flaw allowed authenticated attackers with sufficient privileges to inject malicious scripts into the application's configuration parameters, which would then be executed in the context of other users who viewed the affected profiles. The vulnerability specifically manifested when users configured cloud-based build agents through the TeamCity interface, where input validation was insufficient to prevent script injection attacks.
The technical implementation of this vulnerability stemmed from inadequate sanitization of user-supplied data within the Cloud Profiles configuration section. When administrators or authorized users entered profile names, agent parameters, or other configurable fields containing malicious script code, the system failed to properly escape or validate these inputs before storing them in the database. This stored data was subsequently rendered in web interfaces without proper output encoding, creating the classic stored XSS attack vector. The vulnerability could be exploited by attackers who had access to the TeamCity administration interface or build configuration capabilities.
The operational impact of this vulnerability was significant for organizations relying on TeamCity for continuous integration and deployment processes. An attacker with access to cloud profile configuration could potentially execute arbitrary JavaScript code in the browsers of other TeamCity users, leading to session hijacking, credential theft, or redirection to malicious sites. The attack could be particularly dangerous in environments where multiple administrators shared the same TeamCity instance, as a single compromised user account could enable attackers to gain broader access to the build infrastructure. Additionally, the stored nature of the vulnerability meant that the malicious scripts would persist until manually removed from the configuration, potentially affecting numerous users over extended periods.
Organizations using affected TeamCity versions should immediately upgrade to version 2023.05.3 or later, which includes proper input validation and output encoding measures for Cloud Profile configurations. Administrators should also implement additional monitoring of configuration changes and consider applying web application firewalls to detect and block suspicious script injections. The vulnerability aligns with CWE-79 Cross-site Scripting and follows ATT&CK technique T1566.002 for credential access through malicious content, highlighting the importance of proper input sanitization in web applications. Regular security audits of configuration interfaces and privilege management reviews should be implemented to prevent similar issues in other components of the CI/CD infrastructure.