CVE-2025-52876: JetBrains TeamCity XSS Vulnerability

CVE-2025-52876 Overview

CVE-2025-52876 is a reflected Cross-Site Scripting (XSS) vulnerability in JetBrains TeamCity versions before 2025.03.3. The flaw resides in the favoriteIcon page, where user-supplied input is echoed into the response without proper output encoding. An authenticated attacker can craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser session. The issue is tracked under CWE-79 and affects the TeamCity continuous integration and delivery server.

Critical Impact
Successful exploitation allows attackers to execute JavaScript in a victim's authenticated TeamCity session, enabling session theft, action forgery, and pivoting to CI/CD pipelines.

Affected Products

JetBrains TeamCity versions prior to 2025.03.3
TeamCity on-premises deployments exposing the favoriteIcon endpoint
All TeamCity user roles interacting with the affected page

Discovery Timeline

2025-06-23 - CVE-2025-52876 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-52876

Vulnerability Analysis

The vulnerability is a reflected XSS flaw located on the favoriteIcon page of JetBrains TeamCity. Reflected XSS occurs when a web application takes user input from an HTTP request and immediately returns it in the response without adequate sanitization or contextual output encoding.

In this case, one or more query parameters processed by the favoriteIcon handler are reflected into HTML markup. An attacker can embed JavaScript payloads inside those parameters. When a victim loads the crafted URL, the browser parses the injected script within the TeamCity origin.

Because TeamCity handles CI/CD pipelines, build configurations, and deployment credentials, script execution in an authenticated session can be leveraged to modify builds, steal API tokens, or manipulate release artifacts. The EPSS probability of 19.702% places this issue in the 97th percentile for likelihood of exploitation.

Root Cause

The root cause is missing or insufficient output encoding on parameters reflected by the favoriteIcon endpoint. User-controlled data is inserted into an HTML context without HTML entity encoding, allowing script tags and event handlers to break out of the intended data context.

Attack Vector

Exploitation requires the attacker to have low-privilege authenticated access and to induce user interaction, typically by delivering a crafted link through phishing or an internal chat channel. The scope is changed, meaning the injected script executes in the security context of the victim's TeamCity session and can affect resources beyond the attacker's own account.

The vulnerability is described in prose only; no verified proof-of-concept is publicly available. See the JetBrains Security Issues Fixed advisory for vendor details.

Detection Methods for CVE-2025-52876

Indicators of Compromise

HTTP requests to the favoriteIcon endpoint containing suspicious characters such as <, >, script, onerror, or URL-encoded equivalents like %3Cscript%3E
Referer headers pointing to external domains for requests targeting favoriteIcon
Unexpected outbound HTTP requests from user browsers to attacker-controlled hosts shortly after visiting TeamCity URLs
New or modified TeamCity API tokens created under user accounts without corresponding user activity

Detection Strategies

Review TeamCity access logs for query strings on the favoriteIcon page that include HTML or JavaScript metacharacters
Enable and monitor Content Security Policy (CSP) violation reports for the TeamCity origin
Correlate authentication events with build configuration changes to identify session abuse
Deploy a web application firewall (WAF) with signatures for reflected XSS payloads targeting CI/CD applications

Monitoring Recommendations

Alert on TeamCity administrative actions performed immediately after user navigation to favoriteIcon URLs
Track outbound network connections from workstations to newly registered or low-reputation domains following TeamCity usage
Audit changes to build steps, VCS roots, and secret parameters for unauthorized modifications

How to Mitigate CVE-2025-52876

Immediate Actions Required

Upgrade all JetBrains TeamCity servers to version 2025.03.3 or later
Invalidate active user sessions and rotate TeamCity API tokens after patching
Restrict TeamCity access to trusted networks or a VPN until the upgrade is complete
Notify users to avoid clicking untrusted links referencing their TeamCity instance

Patch Information

JetBrains has addressed the reflected XSS in TeamCity 2025.03.3. Administrators should consult the JetBrains Security Issues Fixed page for release notes and upgrade guidance, then apply the update through the standard TeamCity upgrade procedure.

Workarounds

Place TeamCity behind a WAF or reverse proxy that filters HTML metacharacters in query parameters to favoriteIcon
Enforce a strict Content Security Policy that disallows inline scripts on the TeamCity origin
Require users to authenticate through single sign-on with short session lifetimes to limit exposure

bash

# Example NGINX reverse proxy rule to block suspicious favoriteIcon requests
location ~* /favoriteIcon {
    if ($args ~* "(<|>|script|onerror|onload|javascript:)") {
        return 403;
    }
    proxy_pass http://teamcity-backend;
}