Em JetBrains TeamCity anterior a 2025.07, um CSRF era possível na integração de login OAuth externo

The CSRF vulnerability in TeamCity allows an attacker to craft malicious requests that appear to originate from a legitimate user. If a user is authenticated and visits a crafted URL, the attacker can potentially trigger actions within the OAuth login flow without the user's knowledge or consent. This could lead to account takeover, unauthorized data access, or other malicious activities depending on the permissions associated with the OAuth integration. The impact is considered low due to the requirement of user interaction and the specific context of the OAuth login flow.

Organizations utilizing JetBrains TeamCity with external OAuth login integrations are at risk. This includes teams relying on OAuth for authentication with third-party services, particularly those with legacy TeamCity configurations or those who have not recently updated their TeamCity instance.

• java / server:

ps -ef | grep TeamCity

• java / server:

journalctl -u teamcity-server | grep -i "oauth"

• generic web:

curl -I https://teamcity.example.com/oauth/authorize

• generic web:

grep -r "oauth_token" /var/log/apache2/access.log

1. 2025-07-28Disclosure

   disclosure

1. Reservado2025-07-24
2. Publicada2025-07-28
3. EPSS atualizado2026-03-23

The primary mitigation for CVE-2025-54529 is to upgrade TeamCity to version 2025.07 or later, which includes the fix. If upgrading immediately is not feasible, consider implementing stricter input validation and output encoding within the OAuth integration to reduce the attack surface. Review and restrict OAuth scopes granted to third-party applications to minimize potential damage. Implement CSRF protection mechanisms, such as synchronizer tokens or double-submit cookies, within the OAuth login process as a temporary workaround. After upgrading, confirm the fix by attempting a CSRF attack on the OAuth login endpoint and verifying that the request is rejected.