JetBrains TeamCity DOM-Based Cross-Site Scripting Vulnerability

A vulnerability allowing for multiple DOM-based cross-site scripting (XSS) attacks has been identified in JetBrains TeamCity versions prior to 2024.12.2. This issue was reported by a JetBrains team member and is documented in the TeamCity issue tracker.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, navigate to the Code Inspection Report tab in JetBrains TeamCity. The XSS can be triggered by manipulating the DOM in a way that injects malicious scripts, which are then executed.

Remediation

Users can update to JetBrains TeamCity version 2024.12.2 or later to address this vulnerability.