- Application/component: JetBrains TeamCity
- Affected version: < 2024.07.3
- Score (CVSS 3.1): 5.4 Medium
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CWEs:CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
CVE: CVE-2024-47950
During a more detailed analysis of JetBrains TeamCity, I identified a vulnerability.
Description
TeamCity supports creating backups. To create backups, a user requires the
Change backup settings and control backup process permission.
The name of a backup file can be entered on the relevant screen. The file name is displayed on both the Run Backup
tab and the History tab. The input is not sanitized.
If JavaScript code / HTML code is entered, that code is executed, resulting in a (stored) XSS vulnerability.
Proof of Concept
The following file name is entered in the Backup file field on the Run Backup tab:
">alert();
When the “Start Backup” button is pressed, the code is executed:
When the “History” tab is opened, the code is executed repeatedly (stored XSS):
Lessons learned
All input must be validated and sanitized. Although the impact in this
case was limited—only users who also held this permission could be attacked, and the session cookies were protected with HttpOnly—this
can still lead to successful attacks depending on the use case. The risk should not be underestimated, particularly in the context of internal phishing.
Note
All tests were performed on my own local instance (using Docker) and with test user data that I created myself.
JetBrains responded quickly, constructively, and professionally.
Timeline
- Reported to JetBrains on September 12, 2024
- Response received on September 12, 2024
- Issue fixed on September 24, 2024
- Patch released on October 1, 2024
- CVE entry published as CVE-2024-47950 on October 8, 2024
- Blog post released on May 13, 2025