CVE-2025-26493 in TeamCity
Summary
by MITRE • 02/11/2025
In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/16/2025
The vulnerability identified as CVE-2025-26493 represents a significant security flaw in JetBrains TeamCity versions prior to 2024.12.2, specifically affecting the Code Inspection Report tab functionality. This issue manifests as multiple DOM-based cross-site scripting vulnerabilities that could potentially allow attackers to execute malicious scripts within the context of a victim's browser session. The vulnerability stems from insufficient input validation and output encoding mechanisms within the code inspection reporting component, creating an attack surface where malicious payloads could be injected and subsequently executed when users navigate to the affected report tab.
The technical nature of this vulnerability falls under the category of DOM-based cross-site scripting as classified by CWE-79, which occurs when malicious script code is executed as a result of modifying the DOM environment in the victim's browser. The flaw is particularly concerning because it affects a core reporting functionality that administrators and developers frequently access during code review and quality assurance processes. Attackers could exploit this vulnerability by crafting malicious input that gets processed and rendered within the code inspection report interface, potentially leading to session hijacking, data exfiltration, or privilege escalation within the TeamCity environment.
The operational impact of this vulnerability extends beyond simple script execution, as it could enable attackers to gain unauthorized access to sensitive code inspection data, manipulate reporting results, or even establish persistent access through more sophisticated attack vectors. The Code Inspection Report tab serves as a critical interface for developers to identify code quality issues and security vulnerabilities, making it an attractive target for adversaries seeking to compromise development workflows. When users access the affected reports, the malicious scripts would execute in their browser context, potentially allowing attackers to steal session cookies, redirect users to malicious sites, or inject additional malicious content into the development environment.
Organizations utilizing JetBrains TeamCity versions before 2024.12.2 face significant risk from this vulnerability, particularly in environments where development teams regularly access code inspection reports and where users may not be security-aware. The vulnerability aligns with ATT&CK technique T1566.001 which involves phishing attacks through social engineering, as attackers could potentially craft malicious code inspection reports that appear legitimate to developers. Security teams should prioritize immediate remediation through updating to TeamCity 2024.12.2 or later, which includes proper input sanitization and output encoding mechanisms. Additionally, implementing web application firewalls and monitoring for suspicious report access patterns can provide additional layers of protection while awaiting the official security patch deployment.