CVE-2025-59457: JetBrains TeamCity Info Disclosure Flaw

CVE-2025-59457 Overview

CVE-2025-59457 affects JetBrains TeamCity versions prior to 2025.07.2. The vulnerability stems from missing Git URL validation, which allows credential leakage on Windows hosts. An authenticated attacker with low privileges can supply a crafted Git URL that causes TeamCity to leak stored credentials during repository operations. JetBrains tracks the issue in its public security bulletin and shipped a fix in 2025.07.2.

Critical Impact

Authenticated attackers with project-level access can exfiltrate Git credentials stored in TeamCity, enabling lateral movement into source code repositories and downstream CI/CD systems.

Affected Products

• JetBrains TeamCity versions before 2025.07.2 running on Windows
• TeamCity build agents and server components handling Git VCS roots
• CI/CD pipelines using stored Git credentials within affected TeamCity instances

Discovery Timeline

• 2025-09-17 - CVE-2025-59457 published to NVD
• 2025-09-22 - Last updated in NVD database

Technical Details for CVE-2025-59457

Vulnerability Analysis

The flaw is classified under [CWE-183] (Permissive List of Allowed Inputs). TeamCity accepts Git repository URLs without validating their structure or scheme before passing them to the Git client on Windows. The Git client interprets specially crafted URL components as local paths, UNC paths, or helper invocations, causing it to expose credentials configured for the VCS root.

The attack requires network access to the TeamCity server and authenticated access with permission to configure or modify a VCS root. No user interaction is required. Successful exploitation results in disclosure of sensitive credentials without affecting integrity or availability of the TeamCity service itself. The scope is changed because credentials issued to TeamCity grant access to external Git hosting providers.

Root Cause

TeamCity fails to enforce an allowlist of acceptable URL schemes and path formats for Git VCS roots on Windows. Git on Windows supports several URL handling behaviors, including credential helper invocation and filesystem path resolution, that an attacker can abuse when the application does not sanitize input.

Attack Vector

An attacker with project administrator or VCS root configuration rights submits a malicious Git URL when creating or editing a VCS root. When TeamCity executes a Git operation such as fetch or clone on the Windows agent or server, the Git process resolves the crafted URL and writes or transmits the stored credentials to a location the attacker controls.

No verified public proof-of-concept code is available. Refer to the JetBrains Security Issues Fixed advisory for vendor-confirmed technical details.

Detection Methods for CVE-2025-59457

Indicators of Compromise

• Unexpected modifications to VCS root configurations referencing unusual URL schemes, UNC paths (\\host\share), or local filesystem paths
• Git process execution on TeamCity Windows hosts spawning credential helper binaries from non-standard locations
• Outbound network connections from TeamCity agents to hosts not associated with configured Git providers

Detection Strategies

• Audit TeamCity configuration history for VCS root URL changes made by non-administrative users since deployment of affected versions
• Inspect TeamCity server and agent logs for Git command invocations containing URL parameters with embedded shell metacharacters or non-HTTPS schemes
• Correlate authentication events on connected Git hosting providers with TeamCity activity to identify unauthorized credential use

Monitoring Recommendations

• Enable verbose audit logging for VCS root creation, modification, and credential assignment events
• Forward TeamCity audit and build logs to a centralized SIEM and alert on anomalous Git URL patterns
• Monitor egress traffic from CI/CD infrastructure for connections to unfamiliar destinations during build operations

How to Mitigate CVE-2025-59457

Immediate Actions Required

• Upgrade JetBrains TeamCity to version 2025.07.2 or later on all Windows-based servers and agents
• Rotate all Git credentials and access tokens stored in TeamCity VCS roots, treating them as potentially exposed
• Review and restrict project administrator and VCS root configuration permissions to the minimum required user set

Patch Information

JetBrains released the fix in TeamCity 2025.07.2. The vendor advisory and remediation guidance are published at the JetBrains Security Issues Fixed page. Apply the update through the standard TeamCity upgrade procedure, ensuring both server and connected build agents are running patched versions.

Workarounds

• Restrict VCS root configuration privileges to a small group of trusted administrators until patching is complete
• Replace long-lived Git credentials with short-lived tokens scoped to specific repositories to limit the impact of leakage
• Audit existing VCS roots and remove or recreate any with suspicious URL configurations

# Verify TeamCity server version after upgrade
curl -s -u <admin>:<token> https://teamcity.example.com/app/rest/server | grep version

# Expected output should show version 2025.07.2 or later