CVE-2022-48428

What it actually does

This vulnerability is a stored cross-site scripting flaw in JetBrains TeamCity versions before 2022.10.3 affecting the SSH keys page. An authenticated user with access sufficient to create or modify SSH key-related content could persist malicious script content that is later rendered in another user's browser. Because the CVSS scope is changed, successful exploitation can execute attacker-controlled JavaScript in the context of the TeamCity web application session of a victim user, potentially allowing theft of visible data, unauthorized UI actions within the victim's privileges, modification of build configuration data accessible to the victim, or pivoting to other application functionality exposed through the browser session. The flaw does not directly provide code execution on the TeamCity server, but it can facilitate account/session abuse and CI/CD pipeline manipulation if a privileged TeamCity user views the affected page.

Why it matters to the business

TeamCity is commonly used to orchestrate software builds and deployments, so compromise of a privileged web session can have consequences beyond the web application itself. An attacker who can place malicious content and lure or wait for an administrator or project maintainer to view the SSH keys page may be able to alter CI/CD settings, access sensitive project information visible in the UI, or perform actions that affect build integrity. The CVSS score is moderate, but the EPSS value is high, indicating elevated likelihood of exploitation activity relative to many vulnerabilities. Organizations using TeamCity before 2022.10.3 should treat this as important because CI/CD systems often hold source-code access, deployment credentials, build secrets, and release automation privileges.

How an attack unfolds

An attacker first obtains a low-privileged authenticated TeamCity account or compromises an existing account. The attacker then navigates to the SSH keys functionality and stores crafted input containing JavaScript or HTML designed to execute when the SSH keys page is rendered. The payload remains in the TeamCity application until removed or sanitized. When a victim user, ideally an administrator, project administrator, or build maintainer, views the affected SSH keys page, the browser executes the attacker-controlled script in the TeamCity web application context. The script may read information available in the page, make authenticated requests using the victim's active session, change TeamCity configuration, create or modify access artifacts, or stage further social engineering. Exploitation requires authentication and user interaction by the victim, but no complex technical preconditions are indicated.

How to fix it

Upgrade JetBrains TeamCity to version 2022.10.3 or later. If immediate upgrade is not possible, restrict access to the SSH keys page and administrative/project-maintainer functions to trusted users only, review and remove suspicious SSH key entries or metadata, and apply compensating controls such as strong authentication, least-privilege roles, administrative session timeouts, and network access restrictions for the TeamCity web interface. Because stored XSS can persist in application data, upgrading should be paired with review and cleanup of existing SSH key records and any other user-supplied fields rendered on the affected page. Ensure browser security controls such as Content Security Policy are enabled if supported, but do not rely on them as the primary fix.

How to confirm the fix worked

Confirm the TeamCity server reports version 2022.10.3 or later from the application UI, server startup logs, package metadata, or deployment artifact version. Review the SSH keys page after upgrade and verify that previously stored special characters such as angle brackets, quotes, and script-like strings are encoded and displayed as inert text rather than executed markup. In a non-production test environment, attempt to save a harmless XSS test string such as <script>alert(1)</script> or an encoded image onerror handler in SSH key-related fields and confirm it is blocked or safely rendered. Validate that only authorized users can access SSH key management pages and that audit logging captures creation, deletion, and modification of SSH keys.

Typical attack path

1. Gain authenticated access to JetBrains TeamCity with permission to interact with SSH key-related functionality.
2. Create or modify SSH key page content using a crafted stored XSS payload.
3. Wait for or entice a more privileged TeamCity user to open the SSH keys page.
4. Execute JavaScript in the victim's browser under the TeamCity web application origin.
5. Use the victim's session to read sensitive UI data or submit unauthorized TeamCity actions.
6. Optionally remove or alter the payload to reduce evidence of exploitation.

How to detect it

Look for evidence in TeamCity audit logs, application/server logs, reverse proxy logs, and web access logs. Focus on SSH key creation, update, deletion, or viewing events before upgrade, especially records containing HTML tags, JavaScript protocol handlers, event handlers, encoded script content, or unusually long field values. Correlate a suspicious SSH key modification by one user with later page views by administrators or project maintainers, followed by unexpected configuration changes, user/role changes, token or key creation, build trigger changes, VCS root changes, deployment setting changes, or unusual API calls from the victim's session. Review browser-side telemetry, EDR, or proxy logs where available for requests from TeamCity pages to unfamiliar external domains, as XSS payloads often exfiltrate data using outbound HTTP requests. If a payload is found, preserve the stored value, related audit events, access logs, affected user session timelines, and any subsequent administrative actions for incident response.

• <script
• </script>
• javascript:
• onerror=
• onload=
• onclick=
• onmouseover=
• document.cookie
• document.location
• window.location
• localStorage
• sessionStorage
• fetch(
• XMLHttpRequest
• new Image()
• img src=x
• svg onload=
• iframe src=
• eval(
• atob(
• /admin/admin.html?item=sshKeys
• /admin/editProject.html
• /admin/editBuild.html
• /httpAuth/app/rest/

What your security team should do

• Prioritize upgrading all JetBrains TeamCity deployments to 2022.10.3 or later, especially internet-accessible or broadly accessible instances.
• Inventory TeamCity instances and confirm whether any are running versions before 2022.10.3.
• Review TeamCity users, roles, and project permissions to reduce the number of accounts able to create or modify SSH key-related content.
• Inspect SSH key records and related audit history for unusual entries, HTML/script-like content, recent unexpected changes, or changes by low-privileged users.
• Hunt web access logs and TeamCity audit logs for access to SSH key pages followed by unexpected administrative actions, configuration changes, token/key changes, or build/deployment modifications.
• Force reauthentication or terminate active TeamCity sessions if suspicious stored content is found.
• Rotate sensitive credentials, SSH keys, access tokens, and deployment secrets if evidence suggests a privileged TeamCity session was abused.
• Place TeamCity behind VPN, SSO, conditional access, or other network/authentication controls where feasible.