CVE-2025-57734: JetBrains TeamCity Information Disclosure

CVE-2025-57734 Overview

CVE-2025-57734 is an information disclosure vulnerability in JetBrains TeamCity versions prior to 2025.07.1. The flaw exposes Amazon Web Services (AWS) credentials inside Docker script files generated by the continuous integration server. Authenticated users with access to the affected build configurations can retrieve credentials intended to remain confidential. The weakness is categorized under [CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory].

JetBrains addressed the issue in TeamCity 2025.07.1 and documented the fix in the JetBrains Security Issue Resolutions page.

Critical Impact
Exposed AWS credentials can allow attackers to pivot into cloud environments, access storage buckets, and move laterally across AWS services.

Affected Products

JetBrains TeamCity versions prior to 2025.07.1
Docker script generation functionality within TeamCity build configurations
Deployments integrated with AWS connections for cloud build and deployment pipelines

Discovery Timeline

2025-08-20 - CVE-2025-57734 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-57734

Vulnerability Analysis

TeamCity generates Docker script files to orchestrate container-based build steps. In vulnerable releases, the server writes AWS credentials into these script files in cleartext rather than injecting them through secure environment references or masked parameters. Any user or process able to read the generated scripts obtains valid AWS access material.

The exposure persists for the lifetime of the script artifact. Credentials may remain accessible through build logs, workspace directories, and cached artifacts long after the pipeline completes. This widens the window during which an attacker can harvest the material.

Root Cause

The root cause is improper handling of secret parameters during Docker script file generation. TeamCity should treat AWS credentials as masked secrets and reference them through secure injection mechanisms. Instead, the credentials are serialized directly into script files stored on the server and reachable through authenticated endpoints.

Attack Vector

Exploitation requires network access to the TeamCity server and valid low-privilege authentication. An attacker with permission to view build configurations, logs, or Docker script artifacts can read the embedded AWS keys. The flaw affects confidentiality only; integrity and availability of TeamCity itself are not impacted. However, harvested AWS credentials enable follow-on attacks against the connected cloud account.

No public proof-of-concept or exploitation in the wild has been reported for CVE-2025-57734.

Detection Methods for CVE-2025-57734

Indicators of Compromise

Presence of AWS access key identifiers (AKIA, ASIA prefixes) inside TeamCity Docker script files or build logs
Unexpected AWS API calls originating from IP addresses associated with TeamCity agents or external hosts
CloudTrail entries showing credential use outside documented build windows or from unknown user agents

Detection Strategies

Scan the TeamCity server filesystem and build artifact storage for Docker scripts containing credential patterns
Review AWS Identity and Access Management (IAM) usage logs for keys bound to TeamCity service accounts
Correlate TeamCity audit logs with AWS CloudTrail to identify credential retrieval followed by anomalous API activity

Monitoring Recommendations

Enable AWS CloudTrail and GuardDuty alerts for TeamCity-associated IAM principals
Monitor access to build log endpoints and Docker script artifacts for unusual read patterns
Alert on credential-shaped strings written to artifact storage using data loss prevention tooling

How to Mitigate CVE-2025-57734

Immediate Actions Required

Upgrade JetBrains TeamCity to version 2025.07.1 or later
Rotate every AWS access key and secret key that was referenced by affected TeamCity projects
Audit AWS CloudTrail for suspicious activity using the exposed credentials since the vulnerable version was deployed
Restrict access to build configurations and Docker script artifacts to the minimum required user set

Patch Information

JetBrains resolved the vulnerability in TeamCity 2025.07.1. Fix details and additional advisories are published on the JetBrains Security Issue Resolutions page. Administrators should follow the standard TeamCity upgrade procedure and verify the server version after patching.

Workarounds

Replace static AWS access keys with short-lived credentials via AWS Security Token Service (STS) or OpenID Connect federation
Store AWS credentials in TeamCity as typed password parameters and reference them only through masked environment variables
Remove existing Docker script artifacts and build logs that may contain exposed credentials

bash

# Verify TeamCity server version after upgrade
curl -s https://<teamcity-host>/app/rest/server --user <admin>:<token> | grep version

# Example: rotate an exposed AWS access key
aws iam create-access-key --user-name teamcity-ci
aws iam update-access-key --access-key-id AKIAEXAMPLE --status Inactive --user-name teamcity-ci
aws iam delete-access-key --access-key-id AKIAEXAMPLE --user-name teamcity-ci