CVE-2025-46433: JetBrains TeamCity Path Traversal Flaw

CVE-2025-46433 Overview

CVE-2025-46433 is a critical path traversal vulnerability in JetBrains TeamCity, a popular continuous integration and deployment server. The vulnerability exists due to improper path validation in the loggingPreset parameter, allowing attackers to traverse directory structures and potentially access or manipulate sensitive files outside the intended directory.

Critical Impact

This path traversal vulnerability allows unauthenticated remote attackers to exploit improper path validation, potentially leading to unauthorized file access, information disclosure, or complete system compromise.

Affected Products

• JetBrains TeamCity versions before 2025.03.1

Discovery Timeline

• 2025-04-25 - CVE-2025-46433 published to NVD
• 2025-05-16 - Last updated in NVD database

Technical Details for CVE-2025-46433

Vulnerability Analysis

This vulnerability falls under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-23 (Relative Path Traversal). The flaw resides in how TeamCity handles the loggingPreset parameter, which fails to properly sanitize user-supplied input containing path traversal sequences.

TeamCity, being a CI/CD platform, has extensive access to build artifacts, configuration files, credentials, and deployment pipelines. An attacker exploiting this vulnerability could potentially access sensitive configuration files, steal credentials stored in the system, or manipulate build processes. The vulnerability requires no authentication and can be exploited remotely over the network with low complexity, making it particularly dangerous for internet-exposed TeamCity instances.

Root Cause

The root cause is improper input validation in the loggingPreset parameter handling code. The application fails to adequately sanitize path traversal sequences such as ../ or encoded variants before using the parameter in file system operations. This allows attackers to break out of the intended directory and navigate to arbitrary locations on the file system accessible to the TeamCity process.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can craft malicious HTTP requests containing path traversal sequences in the loggingPreset parameter. When TeamCity processes these requests, the unsanitized input allows directory traversal, enabling the attacker to access files outside the restricted directory structure. Given TeamCity's typical deployment in enterprise environments with access to source code, build secrets, and deployment credentials, successful exploitation could lead to significant downstream compromise.

The vulnerability mechanism involves sending specially crafted requests where the loggingPreset parameter contains directory traversal sequences (e.g., ../../etc/passwd or ..\..\windows\system32\config\sam). The server processes this malicious input without proper validation, potentially allowing attackers to read sensitive system files, configuration data, or credentials stored on the server. For detailed technical information, refer to the JetBrains Security Advisory.

Detection Methods for CVE-2025-46433

Indicators of Compromise

• HTTP requests containing path traversal sequences (../, ..%2f, ..%5c) in the loggingPreset parameter
• Unusual file access patterns in TeamCity logs indicating access to files outside normal directories
• Web server logs showing requests with encoded traversal characters targeting TeamCity endpoints
• Unexpected access to system configuration files or sensitive directories from the TeamCity process

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns in request parameters
• Monitor TeamCity application logs for unusual file access attempts or error messages related to file operations
• Deploy network intrusion detection systems (NIDS) with signatures for path traversal attack patterns
• Enable verbose logging on TeamCity servers and review for anomalous parameter values in HTTP requests

Monitoring Recommendations

• Configure SIEM alerts for requests containing directory traversal sequences targeting TeamCity endpoints
• Monitor file integrity on TeamCity servers to detect unauthorized access to sensitive configuration files
• Review audit logs for any evidence of unauthorized data access or configuration changes
• Implement endpoint detection and response (EDR) monitoring on TeamCity server infrastructure

How to Mitigate CVE-2025-46433

Immediate Actions Required

• Upgrade JetBrains TeamCity to version 2025.03.1 or later immediately
• If immediate patching is not possible, restrict network access to TeamCity servers using firewall rules
• Implement WAF rules to filter path traversal attempts in all request parameters
• Audit TeamCity server logs for any evidence of exploitation attempts

Patch Information

JetBrains has released a security patch addressing this vulnerability in TeamCity version 2025.03.1. Organizations should upgrade to this version or later as soon as possible. The patch information and additional security fixes are documented on the JetBrains Security Issues Fixed page.

Workarounds

• Restrict network access to TeamCity instances using firewall rules to allow only trusted IP addresses
• Deploy a reverse proxy or WAF in front of TeamCity with rules to block path traversal patterns
• Disable external network access to TeamCity until patching is complete if the server does not require internet exposure
• Monitor all incoming requests for suspicious patterns while awaiting the upgrade window

# Example: Restrict TeamCity access using iptables (Linux)
# Allow access only from trusted management network
iptables -A INPUT -p tcp --dport 8111 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8111 -j DROP