CVE-2025-24460: JetBrains TeamCity Information Disclosure

CVE-2025-24460 Overview

CVE-2025-24460 is an improper access control vulnerability in JetBrains TeamCity versions before 2024.12.1. The flaw allows authenticated users to view project names in the agent pool that should be restricted based on their permissions. The issue is categorized under [CWE-863] Incorrect Authorization and affects the continuous integration and deployment server used across enterprise development environments.

Critical Impact
Authenticated attackers with low privileges can enumerate project names visible in the agent pool, exposing information about internal build pipelines and organizational structure.

Affected Products

JetBrains TeamCity versions prior to 2024.12.1
TeamCity on-premises deployments using shared agent pools
TeamCity build configurations with restricted project visibility

Discovery Timeline

2025-01-21 - CVE-2025-24460 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24460

Vulnerability Analysis

The vulnerability resides in the agent pool interface of JetBrains TeamCity. Authorization checks fail to filter project names presented to users based on their assigned permissions. Users authenticated to the TeamCity instance can therefore observe names of projects they should not have visibility into.

The issue is an information disclosure flaw driven by broken access control. It does not permit modification of build data, injection of code, or disruption of service. Confidentiality is the only security property affected, and the scope is limited to project name metadata visible through the agent pool.

Root Cause

The root cause is missing authorization enforcement on the agent pool listing endpoint. The server retrieves project associations tied to agent pools without validating whether the requesting user holds the VIEW_PROJECT permission for each returned project. This is a classic incorrect authorization pattern where display logic omits per-object permission checks.

Attack Vector

An attacker requires network access to the TeamCity web interface and a valid low-privileged account. The attacker navigates to the agent pool view and observes project names that would otherwise be hidden by role-based access controls. No user interaction beyond the attacker's own session is required, and the attack complexity is low.

Exploitation does not produce artifacts in build logs or code repositories. Disclosed project names may reveal customer names, internal product codenames, security tooling, or acquisition activity depending on the organization's naming conventions. See the JetBrains Security Issues Fixed advisory for vendor details.

Detection Methods for CVE-2025-24460

Indicators of Compromise

Unusual access patterns to the /agentPools or agent pool administration endpoints from accounts that do not manage build agents
Web server access logs showing authenticated users querying agent pool views repeatedly across sessions
Audit log entries showing project enumeration activity from accounts with narrow project assignments

Detection Strategies

Review TeamCity audit logs for account access to agent pool pages that is inconsistent with the user's assigned build responsibilities
Correlate authenticated web requests to agent pool endpoints against the requesting user's project role assignments
Baseline typical agent pool page traffic and alert on deviations from developer or operator accounts

Monitoring Recommendations

Forward TeamCity access logs and audit events to a centralized logging platform for retention and query
Enable alerts on repeated access to administrative and agent management endpoints by non-administrative accounts
Track version identifiers reported by TeamCity servers to confirm patched builds are deployed across all instances

How to Mitigate CVE-2025-24460

Immediate Actions Required

Upgrade all TeamCity servers to version 2024.12.1 or later
Audit user accounts and remove unused or over-privileged accounts on the TeamCity instance
Review project naming conventions and rename projects whose names expose sensitive business information

Patch Information

JetBrains addressed this issue in TeamCity 2024.12.1. Administrators should apply the update through the standard TeamCity upgrade process and validate the running version in the server administration console. Refer to the JetBrains Security Issues Fixed page for the full advisory.

Workarounds

Restrict network access to the TeamCity web interface using firewall rules or VPN gating until the patch is applied
Limit account creation and enforce the principle of least privilege for all TeamCity roles
Avoid embedding sensitive identifiers such as customer names or codenames in TeamCity project titles

bash

# Verify running TeamCity server version
curl -s -u <user>:<token> https://teamcity.example.com/app/rest/server | grep -i version

# Confirm version is 2024.12.1 or later before returning the server to production use