CVE-2025-31139: JetBrains TeamCity Information Disclosure

CVE-2025-31139 Overview

CVE-2025-31139 is an information disclosure vulnerability affecting JetBrains TeamCity versions prior to 2025.03. The flaw allows base64-encoded passwords to be exposed in the build log, weakening the confidentiality of credentials handled by the continuous integration server. The issue is categorized under [CWE-532] Insertion of Sensitive Information into Log File. An authenticated user with permission to trigger or view builds can retrieve credentials that should remain hidden. JetBrains addressed the vulnerability in TeamCity 2025.03.

Critical Impact
Authenticated users with build log access can recover base64-encoded credentials, enabling credential reuse against downstream systems integrated with TeamCity.

Affected Products

JetBrains TeamCity versions prior to 2025.03
On-premises TeamCity server deployments
TeamCity build agents that surface log output to the server

Discovery Timeline

2025-03-27 - CVE-2025-31139 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31139

Vulnerability Analysis

The vulnerability stems from insufficient sanitization of secret values before they reach the TeamCity build log. TeamCity normally masks parameters marked as passwords, replacing them with placeholder text in log output. When a password is encoded with base64 prior to being written to the log, the masking routine fails to recognize the transformed value as sensitive. The encoded string is then written to the log in clear form and can be decoded trivially by any user with log read access.

Exploitation requires low privileges and no user interaction. An attacker with an authenticated TeamCity account and permission to view build results can browse historical build logs, extract base64 tokens, and decode them offline. Credentials commonly exposed through CI logs include artifact repository tokens, cloud provider keys, and deployment credentials for production systems.

Root Cause

The root cause is a gap in the secret redaction logic. TeamCity's log filter compares log output against the raw parameter value stored in the build configuration. Base64 encoding produces a string that no longer matches the stored secret, bypassing the redaction filter. This is a classic [CWE-532] insertion of sensitive information into log files, compounded by an encoding-aware masking gap.

Attack Vector

The attack vector is network-based and requires authenticated low-privilege access to the TeamCity server. An attacker executes or observes a build step that echoes an encoded credential, such as an HTTP Authorization: Basic header used in a curl invocation. The encoded token appears verbatim in the log. The attacker then decodes the string to recover the username and password pair.

The vulnerability is described in the JetBrains Privacy and Security Fixes advisory. No public proof-of-concept has been published.

Detection Methods for CVE-2025-31139

Indicators of Compromise

Build log entries containing long base64 strings adjacent to Authorization, Basic, or -u command-line flags
Access log entries showing repeated downloads of build logs by non-administrative user accounts
Unexpected authentication events on downstream systems using credentials that were referenced in TeamCity builds

Detection Strategies

Scan historical build logs for regular-expression patterns matching base64-encoded credential formats such as Basic [A-Za-z0-9+/=]{20,}
Correlate TeamCity audit events for build log retrieval with user role assignments to flag over-privileged accounts
Alert on build steps that invoke echo, printf, or shell redirection referencing password-type parameters

Monitoring Recommendations

Forward TeamCity server and agent logs to a centralized data lake for retrospective secret scanning
Enable audit logging on the TeamCity REST API endpoints that expose build logs
Rotate CI-managed credentials on a fixed schedule and monitor downstream systems for unauthorized use

How to Mitigate CVE-2025-31139

Immediate Actions Required

Upgrade TeamCity server and all connected build agents to version 2025.03 or later
Rotate every credential stored in TeamCity that may have appeared in build logs prior to the upgrade
Restrict the View build runtime parameters and log-view permissions to trusted roles only
Purge or archive historical build logs that contain encoded credentials

Patch Information

JetBrains resolved CVE-2025-31139 in TeamCity 2025.03. Administrators should follow the upgrade guidance published on the JetBrains Privacy and Security Fixes page. After patching, verify that base64-encoded password parameters are correctly masked in a controlled test build before restoring normal operations.

Workarounds

Avoid encoding password-type parameters with base64 inside build scripts; pass credentials through environment variables consumed directly by tools
Configure build steps to suppress command echoing, for example using set +x in shell scripts before referencing secrets
Store sensitive credentials in an external secrets manager and inject them at runtime rather than as TeamCity parameters

bash

# Configuration example: disable command echoing before using secrets
set +x
curl -H "Authorization: Basic ${ENCODED_TOKEN}" https://artifact.example.com/api
set -x