CVE-2025-31140: JetBrains TeamCity XSS Vulnerability

CVE-2025-31140 Overview

CVE-2025-31140 is a stored cross-site scripting (XSS) vulnerability affecting JetBrains TeamCity versions before 2025.03. The flaw resides in the Cloud Profiles page, where attacker-controlled input persists in the application and executes in the browser context of other users. Successful exploitation requires user interaction, but the scope-changed impact allows the injected script to affect resources beyond the vulnerable component. The issue is tracked under CWE-79 and was fixed in TeamCity 2025.03.

Critical Impact
Attackers with the ability to configure Cloud Profiles can inject persistent JavaScript that executes when other authenticated users, including administrators, view the affected page.

Affected Products

JetBrains TeamCity versions prior to 2025.03
On-premises TeamCity server installations exposing the Cloud Profiles configuration UI
CI/CD environments where multiple users share administrative access to build infrastructure

Discovery Timeline

2025-03-27 - CVE-2025-31140 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31140

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Cloud Profiles configuration page of JetBrains TeamCity. TeamCity's Cloud Profiles allow administrators to define cloud agent integrations with providers such as Amazon EC2, Azure, and Kubernetes. Input submitted through this interface is stored server-side and later rendered without adequate output encoding. When another user loads the Cloud Profiles page, the browser interprets the injected payload as executable JavaScript in the TeamCity origin.

An attacker exploiting this flaw can perform actions in the victim's session, exfiltrate session tokens, or pivot to other TeamCity functionality. Because TeamCity administrators typically hold privileged CI/CD authority, script execution in an admin session can lead to build pipeline tampering, credential theft, and supply chain compromise.

Root Cause

The root cause is improper neutralization of input during web page generation on the Cloud Profiles page. User-controlled fields are stored in TeamCity's configuration database and rendered into HTML without proper contextual encoding, permitting HTML and JavaScript syntax to break out of the intended text context.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker with permissions to modify Cloud Profile configuration submits a crafted payload containing JavaScript. The payload persists until a victim, typically an administrator, navigates to the Cloud Profiles page, at which point the script executes in the victim's browser under the TeamCity domain.

The vulnerability manifests through unsanitized rendering of Cloud Profile input fields. JetBrains has not published proof-of-concept code, and no public exploit is available. See the JetBrains Security Issues Fixed page for vendor details.

Detection Methods for CVE-2025-31140

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or HTML event handlers stored in Cloud Profile name or description fields
Anomalous outbound requests from administrator browsers to unknown domains shortly after visiting the Cloud Profiles page
Unauthorized changes to build configurations, agent pools, or API tokens following Cloud Profile edits

Detection Strategies

Audit the TeamCity configuration database and XML config files for Cloud Profile fields containing HTML or script syntax
Review TeamCity audit logs for Cloud Profile modifications performed by non-administrator accounts
Inspect browser Content Security Policy violation reports originating from the TeamCity server

Monitoring Recommendations

Enable and centralize TeamCity audit logging, forwarding events to a SIEM for correlation with user session activity
Monitor for unexpected API token creation or permission changes following Cloud Profile page visits by administrators
Track outbound network traffic from workstations used to administer TeamCity for connections to unfamiliar hosts

How to Mitigate CVE-2025-31140

Immediate Actions Required

Upgrade JetBrains TeamCity to version 2025.03 or later, which contains the vendor fix
Review Cloud Profile configurations for any suspicious content stored prior to patching and remove injected payloads
Rotate TeamCity API tokens and administrator credentials if exploitation is suspected

Patch Information

JetBrains addressed the issue in TeamCity 2025.03. Refer to the JetBrains Security Issues Fixed advisory for the complete list of resolved issues in that release. Organizations running on-premises TeamCity should plan upgrade windows and validate build configurations after applying the update.

Workarounds

Restrict Cloud Profile modification permissions to a minimal set of trusted administrators until patching is complete
Deploy a strict Content Security Policy at the reverse proxy in front of TeamCity to limit inline script execution
Require administrators to use dedicated browser profiles when accessing TeamCity to reduce session token exposure

bash

# Verify the running TeamCity server version
curl -sS https://teamcity.example.com/app/rest/server \
  -H "Accept: application/json" \
  -u "$TC_USER:$TC_TOKEN" | jq '.version'

# Confirm the installed version is 2025.03 or later before returning to normal operations