CVE-2022-48343

What it actually does

CVE-2022-48343 is a cross-site scripting vulnerability in the JetBrains TeamCity user creation workflow before version 2022.10.2. An unauthenticated remote attacker can craft input that is later rendered in a victim’s browser during or around user-account creation. Because the CVSS vector indicates user interaction is required and scope is changed, successful exploitation can cause attacker-controlled JavaScript to execute in the security context of a TeamCity web user. This may allow session-context actions, access to page-visible data, modification of accessible settings, or abuse of the victim’s TeamCity privileges, but it does not directly provide server-side code execution.

Why it matters to the business

A vulnerable TeamCity server can be used to compromise developer or administrator browser sessions, potentially exposing build metadata, project configuration, source-control integration details, CI/CD secrets visible to the victim, or enabling unauthorized changes to build and deployment workflows. Since TeamCity commonly sits in software delivery pipelines, even a medium-severity browser-side issue can create operational risk if an attacker can target privileged users. The EPSS score is elevated, indicating meaningful likelihood of exploitation activity relative to many vulnerabilities, although it is not listed in CISA KEV and is not currently identified as ransomware-associated.

How an attack unfolds

An attacker identifies an internet-facing or otherwise reachable JetBrains TeamCity instance running a version earlier than 2022.10.2. They submit specially crafted data through the user creation process or a related account-provisioning path where the vulnerable field is accepted and later displayed without proper output encoding. The attacker then causes a TeamCity user, ideally an administrator or project maintainer, to view the affected page or workflow. When the victim’s browser renders the stored or reflected content, malicious JavaScript executes under the TeamCity web origin. The script can perform actions available to that user, read content accessible in the page context, attempt to exfiltrate tokens or sensitive page data, or modify TeamCity settings if the victim has sufficient permissions. Follow-on abuse may include creating persistence through accounts, changing build configurations, or targeting CI/CD credentials exposed through the web interface.

How to fix it

Upgrade JetBrains TeamCity to version 2022.10.2 or later. If direct upgrade is delayed, reduce exposure by restricting TeamCity access to trusted networks or VPNs, enforcing SSO/MFA for administrative users, limiting who can create or manage users, and reviewing account-registration or invitation workflows. Apply defense-in-depth controls such as strong Content Security Policy where supported, least-privilege TeamCity roles, and regular rotation of CI/CD secrets if exploitation is suspected. Because no specific fixed package list was provided, use JetBrains’ official TeamCity release notes and security advisories to select a currently supported patched release rather than only meeting the minimum fixed version.

How to confirm the fix worked

Confirm the deployed TeamCity version is 2022.10.2 or later from the TeamCity web UI, server logs, or installation metadata. Review the user creation and account-management pages to ensure untrusted input is HTML-encoded and does not execute as script. Security teams may validate remediation in a non-production test environment using harmless XSS test strings to confirm they are rendered inert rather than executed. Also verify that TeamCity is not anonymously reachable unless explicitly required and that user-management permissions are limited to authorized administrators.

Typical attack path

1. Discover a JetBrains TeamCity instance exposed to the network.
2. Determine or assume the instance is running a version before 2022.10.2.
3. Craft a malicious payload for an input handled by the user creation process.
4. Submit the payload so that it is stored or reflected by TeamCity.
5. Induce a legitimate TeamCity user to view the affected page or creation workflow.
6. Execute JavaScript in the victim’s browser under the TeamCity application origin.
7. Use the victim’s session privileges to read sensitive information, perform unauthorized actions, or stage further compromise of CI/CD workflows.

How to detect it

Look for evidence of malicious script content submitted through TeamCity user creation or account-management workflows before upgrade. Relevant sources include TeamCity server access logs, application logs, reverse proxy and WAF logs, identity-provider logs, administrative audit records, and browser or endpoint telemetry for administrators who used TeamCity. Search HTTP requests to user creation, registration, invitation, or administration endpoints for HTML or JavaScript payloads, including encoded variants. Investigate newly created or modified users with unusual names, display names, email fields, or metadata containing markup. Review whether privileged users accessed affected pages shortly after suspicious submissions, followed by unexpected configuration changes, token creation, build configuration edits, plugin changes, or account permission changes. Because this is XSS, server-side artifacts may be limited; correlate suspicious web requests with victim browser activity, outbound connections to attacker-controlled domains, and unusual TeamCity actions performed under legitimate user sessions.

• <script
• </script>
• javascript:
• onerror=
• onload=
• onclick=
• onmouseover=
• document.cookie
• localStorage
• sessionStorage
• fetch(
• XMLHttpRequest
• eval(
• atob(
• btoa(
• String.fromCharCode
• %3Cscript
• %3C%2Fscript%3E
• %6A%61%76%61%73%63%72%69%70%74%3A
• /admin/createUser.html
• /admin/users.html
• /registerUser.html
• /login.html

What your security team should do

• Upgrade all affected TeamCity instances to 2022.10.2 or a later supported release as the primary remediation.
• Prioritize externally accessible TeamCity servers and instances used for production build or deployment pipelines.
• Restrict TeamCity administrative and user-management interfaces to trusted networks or VPN access.
• Review recent user creation, invitation, and account-management activity for unusual entries, unexpected users, or suspicious field values containing script-like content.
• Audit TeamCity administrator and project maintainer sessions around suspicious account-management events.
• Rotate credentials, access tokens, and CI/CD secrets that may have been visible to compromised privileged users if exploitation is suspected.
• Harden TeamCity roles using least privilege and require MFA or equivalent strong authentication for privileged accounts.
• Add SIEM detections for script tags, event-handler attributes, JavaScript URLs, and encoded script payloads submitted to TeamCity account-management endpoints.