CVE-2025-52877 Overview
CVE-2025-52877 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] affecting JetBrains TeamCity versions before 2025.03.3. The flaw resides on the diskUsageBuildsStats page, where unsanitized input is reflected back in server responses. An authenticated attacker with high privileges can craft a malicious URL that executes arbitrary JavaScript in the browser of a victim who follows the link. Successful exploitation can compromise session data, trigger unauthorized actions in the CI/CD console, or facilitate lateral movement within the build pipeline.
Critical Impact
Exploitation enables script execution in an authenticated TeamCity administrator's browser session, exposing build configurations and CI/CD secrets to unauthorized manipulation.
Affected Products
- JetBrains TeamCity versions prior to 2025.03.3
- The diskUsageBuildsStats administrative reporting page
- CI/CD pipelines and integrated services relying on affected TeamCity instances
Discovery Timeline
- 2025-06-23 - CVE-2025-52877 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-52877
Vulnerability Analysis
The vulnerability is a reflected XSS flaw in the TeamCity web interface. The diskUsageBuildsStats page accepts user-controlled parameters and returns them in the HTTP response without sufficient output encoding or input sanitization. When the response renders in a browser, injected script content executes within the origin of the TeamCity server.
Attack execution requires user interaction because the victim must load an attacker-crafted URL. The scope change reflected in the CVSS vector indicates that injected script can affect resources beyond the vulnerable component, including browser storage, cookies, and DOM state tied to the TeamCity origin.
Because TeamCity administrators typically hold broad access to build agents, artifact repositories, and secrets, script execution in an administrator's session can be leveraged to trigger privileged API actions. Reflected XSS in CI/CD tooling frequently serves as an entry point for supply-chain style attacks against downstream build outputs.
Root Cause
The root cause is missing or incomplete output encoding on the diskUsageBuildsStats endpoint. Parameters supplied in the request are echoed into HTML responses without contextual escaping, permitting HTML and JavaScript injection.
Attack Vector
Exploitation is network-based and requires an authenticated attacker holding elevated privileges to craft the payload, plus a victim who clicks the malicious URL. The attacker delivers the link through phishing, chat, ticketing systems, or any channel reaching TeamCity users. Once the victim's browser loads the URL, injected JavaScript runs in the TeamCity origin context.
No verified proof-of-concept exploit code is publicly available. Refer to the JetBrains Security Issues Fixed advisory for vendor-supplied technical context.
Detection Methods for CVE-2025-52877
Indicators of Compromise
- HTTP requests to /diskUsageBuildsStats containing URL-encoded <script> tags, javascript: URIs, or event handler attributes such as onerror= and onload=
- Unusual outbound HTTP requests originating from TeamCity administrator browser sessions to attacker-controlled domains
- Unexpected changes to build configurations, agent pools, or API tokens shortly after an administrator accessed a suspicious link
Detection Strategies
- Inspect TeamCity access logs and web proxy telemetry for anomalous query strings targeting the diskUsageBuildsStats endpoint
- Deploy web application firewall (WAF) rules that flag reflected XSS payloads in requests to TeamCity administrative pages
- Correlate administrative API activity with browser session context to identify actions triggered by injected script rather than direct user input
Monitoring Recommendations
- Enable verbose audit logging for TeamCity administrative endpoints and forward logs to a centralized SIEM for retention and correlation
- Alert on new or modified TeamCity user tokens, build steps, and script runners initiated from administrator sessions
- Monitor email and messaging gateways for links pointing at internal TeamCity hosts that carry suspicious query parameters
How to Mitigate CVE-2025-52877
Immediate Actions Required
- Upgrade all JetBrains TeamCity instances to version 2025.03.3 or later
- Rotate any TeamCity API tokens, service credentials, and integration secrets that may have been exposed during administrator sessions
- Restrict TeamCity administrative interface access to trusted networks or VPN-only reachability until patching completes
Patch Information
JetBrains addressed the issue in TeamCity 2025.03.3. Review the JetBrains Security Issues Fixed page for the full patch listing and version guidance.
Workarounds
- Enforce a strict Content Security Policy (CSP) at the reverse proxy in front of TeamCity to limit inline script execution
- Train administrators to avoid clicking untrusted links that reference internal TeamCity URLs, particularly reporting endpoints
- Limit the number of accounts holding high-privilege TeamCity roles to reduce the exploitable surface for authenticated attackers
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
