CVE-2025-54529: JetBrains TeamCity CSRF Vulnerability

CVE-2025-54529 Overview

CVE-2025-54529 is a Cross-Site Request Forgery (CSRF) vulnerability in JetBrains TeamCity versions before 2025.07. The flaw resides in the external OAuth login integration component. An attacker can craft a malicious request that, when triggered by an authenticated user, performs unintended actions within the OAuth login workflow. The vulnerability is classified under [CWE-352] and affects the jetbrains:teamcity continuous integration server. JetBrains addressed the issue in TeamCity 2025.07.

Critical Impact

Successful exploitation allows attackers to abuse OAuth login integration on behalf of an authenticated TeamCity user, potentially compromising account integrity and pipeline access.

Affected Products

• JetBrains TeamCity versions prior to 2025.07
• TeamCity instances with external OAuth login integration enabled
• Self-hosted TeamCity build management and CI/CD servers

Discovery Timeline

• 2025-07-28 - CVE-2025-54529 published to NVD
• 2025-07-31 - Last updated in NVD database

Technical Details for CVE-2025-54529

Vulnerability Analysis

The vulnerability stems from missing CSRF protections in the external OAuth login integration of JetBrains TeamCity. CSRF attacks exploit the trust a web application places in an authenticated user's browser session. When an authenticated TeamCity user visits a malicious page, the attacker forces the browser to issue a forged request to the TeamCity server. The server processes the request as legitimate because session credentials are automatically attached.

The attack requires user interaction and operates across the network. The high attack complexity reflects the conditions an attacker must align, including timing the request while a victim holds an authenticated session. Successful exploitation can manipulate OAuth integration state, affecting confidentiality, integrity, and availability of the targeted TeamCity instance.

Root Cause

The root cause is the absence of anti-CSRF tokens or equivalent same-origin enforcement on state-changing endpoints used by the OAuth login integration. Without per-request tokens validated against the user session, the server cannot distinguish forged cross-origin requests from legitimate user actions initiated within the TeamCity UI.

Attack Vector

An attacker hosts a crafted web page or injects HTML into a site the victim visits. The page issues a request to the victim's TeamCity instance targeting the OAuth login integration endpoint. Because the victim's browser sends authenticated session cookies, the TeamCity server executes the request. Refer to the JetBrains Security Issues Fixed advisory for vendor-confirmed technical details.

Detection Methods for CVE-2025-54529

Indicators of Compromise

• Unexpected modifications to OAuth login integration configuration in TeamCity audit logs
• HTTP requests to OAuth integration endpoints with Referer or Origin headers pointing to untrusted external domains
• Authentication events tied to OAuth providers that do not match user-initiated activity patterns

Detection Strategies

• Review TeamCity server access logs for cross-origin POST requests to OAuth-related endpoints lacking expected referrer values
• Correlate user session activity with administrative changes to identify forged actions
• Enable verbose audit logging for OAuth integration changes and account-linking operations

Monitoring Recommendations

• Forward TeamCity audit and HTTP access logs to a centralized SIEM for analysis
• Alert on OAuth configuration changes occurring outside scheduled administrative windows
• Monitor for anomalous referer headers on state-changing TeamCity requests

How to Mitigate CVE-2025-54529

Immediate Actions Required

• Upgrade JetBrains TeamCity to version 2025.07 or later as published in the JetBrains Security Issues Fixed advisory
• Audit recent OAuth integration changes and user account linkages for unauthorized modifications
• Notify TeamCity users to avoid clicking untrusted links while authenticated to the server

Patch Information

JetBrains resolved CVE-2025-54529 in TeamCity 2025.07. Administrators should plan an upgrade through the official upgrade process and verify the version after deployment. Vendor remediation details are available on the JetBrains Security Issues Fixed page.

Workarounds

• Restrict TeamCity server exposure to trusted network segments using firewall rules or reverse proxy allow-lists
• Disable external OAuth login integration until the upgrade is applied if business operations permit
• Enforce short session lifetimes and require re-authentication for sensitive administrative actions

# Verify the running TeamCity version after upgrade
curl -s https://teamcity.example.com/app/rest/server | grep -i version

# Restrict access at the reverse proxy (nginx example)
location /oauth/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://teamcity_backend;
}