CVE-2025-52875 in TeamCity
Summary
by MITRE • 06/23/2025
In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/26/2025
The vulnerability identified as CVE-2025-52875 represents a DOM-based cross-site scripting flaw discovered in JetBrains TeamCity prior to version 2025.03.3. This security weakness specifically affects the Performance Monitor page within the TeamCity continuous integration and deployment platform. The issue arises from insufficient input validation and output encoding mechanisms that fail to properly sanitize user-supplied data before it is processed and rendered within the browser's Document Object Model. The vulnerability is categorized under CWE-79 as a cross-site scripting attack that occurs in the DOM, where malicious scripts can be executed in the context of the victim's browser session.
The technical exploitation of this vulnerability occurs when an attacker can manipulate parameters or data that are directly reflected in the Performance Monitor page without proper sanitization. The DOM-based nature of this XSS means that the malicious payload is executed by modifying the DOM structure through JavaScript rather than being injected into server-side responses. Attackers can craft malicious URLs or inject harmful JavaScript code that gets executed when users navigate to the affected page, potentially leading to session hijacking, credential theft, or unauthorized administrative actions within the TeamCity environment. This vulnerability falls under the ATT&CK technique T1531 for Account Access Removal and T1059.007 for Command and Scripting Interpreter, as it enables attackers to execute arbitrary code within user browsers.
The operational impact of CVE-2025-52875 extends beyond simple script execution, as it can compromise the integrity of the entire TeamCity deployment environment. Organizations using affected versions may face unauthorized access to build configurations, sensitive project data, and continuous integration workflows. The vulnerability particularly threatens environments where TeamCity is used for critical software delivery pipelines, as attackers could potentially manipulate build processes or gain access to source code repositories. The risk is amplified when users with administrative privileges access the Performance Monitor page, as this could enable full system compromise. Security teams must consider that this vulnerability could be exploited in conjunction with other attack vectors to establish persistent access within development environments.
Mitigation strategies for CVE-2025-52875 require immediate patching of TeamCity installations to version 2025.03.3 or later, which includes proper input validation and output encoding mechanisms for DOM elements. Organizations should implement comprehensive web application firewall rules to detect and block suspicious parameter patterns targeting the Performance Monitor page. Additional protective measures include enabling Content Security Policy headers that restrict script execution and implementing proper input sanitization routines for all user-supplied data. Security monitoring should be enhanced to detect unusual access patterns to the Performance Monitor page, and privileged user sessions should be protected through multi-factor authentication. Regular security assessments of web applications should include DOM-based XSS testing to prevent similar vulnerabilities from emerging in other components of the TeamCity platform or related systems. The vulnerability demonstrates the importance of maintaining up-to-date security practices and continuous monitoring for DOM-based attack vectors that can bypass traditional server-side input validation mechanisms.