CVE-2023-41249

What it actually does

This is a reflected cross-site scripting vulnerability in the build-step copy workflow of JetBrains TeamCity before 2023.05.3. A crafted request can cause attacker-controlled script content to be reflected into a victim user's browser and executed in the security context of the TeamCity web application. Because exploitation requires a user to open the crafted link or page, the attack depends on user interaction, but it can allow the attacker to read data visible to that user, perform actions as that user within the application, or pivot into additional social-engineering or session-abuse activity. The provided package metadata also lists org.infinispan/infinispan-server-rest as affected with a fix in 15.0.0.Dev04; validate product applicability against vendor advisories because the vulnerability description specifically refers to TeamCity.

Why it matters to the business

An attacker who convinces a user to open a malicious link could abuse that user's browser session to access or change information in a CI/CD system. In a TeamCity context, this can create operational risk because build systems often contain source-code access, build configurations, secrets, deployment metadata, and release automation. The CVSS score is moderate, but the EPSS value is elevated, indicating meaningful likelihood of exploitation activity compared with many vulnerabilities; exposed administrative interfaces and users with high privileges increase urgency.

How an attack unfolds

An attacker identifies an organization using a vulnerable TeamCity version and crafts a URL or request that targets the build-step copy functionality with malicious script embedded in a reflected parameter. The attacker then delivers the link through phishing, chat, issue trackers, documentation pages, or another trusted communication path. When a logged-in TeamCity user opens the link, the application reflects the payload into the response without sufficient output encoding, causing the browser to execute the script under the TeamCity origin. The script can then interact with the application using the victim's authenticated session, potentially reading accessible pages or API responses, changing build-step configuration, triggering user-authorized actions, or staging follow-on attacks such as credential harvesting or malicious build manipulation. Practical impact depends heavily on the privileges of the victim and whether session protections, content security policy, and administrative separation are in place.

How to fix it

Upgrade JetBrains TeamCity to 2023.05.3 or later for the vulnerability described. Where the provided dependency metadata is applicable, upgrade org.infinispan/infinispan-server-rest to 15.0.0.Dev04 or later. Restrict access to CI/CD administrative interfaces to trusted networks or VPN, enforce least privilege for TeamCity users, review and harden session settings, and deploy or tune a Content Security Policy to reduce the impact of any residual XSS. If immediate upgrade is not possible, reduce exposure by limiting access to authenticated trusted users, disabling unnecessary public access, increasing monitoring of suspicious request parameters, and warning privileged users not to open untrusted TeamCity links.

How to confirm the fix worked

Confirm the running TeamCity version is 2023.05.3 or later, or that the affected component has been upgraded to the fixed package version listed by the vendor. Verify dependency manifests, software composition analysis results, container images, and deployed artifacts no longer include vulnerable versions. Attempt a safe, non-executing reflected XSS validation in a test environment using harmless encoded markers in the build-step copy workflow and confirm the marker is properly escaped rather than rendered as executable markup. Review HTTP response headers for security controls such as Content-Security-Policy, HttpOnly and SameSite session cookies, and X-Content-Type-Options. Re-run vulnerability scanning or SCA after deployment to confirm the finding is closed.

Typical attack path

1. Identify a vulnerable TeamCity deployment or component version through internet exposure, headers, login pages, documentation, or internal reconnaissance.
2. Craft a reflected XSS payload targeting the build-step copy workflow or associated request parameters.
3. Send the malicious link to a TeamCity user, preferably a project administrator or CI/CD operator.
4. Victim opens the link while authenticated to the vulnerable application.
5. Browser executes attacker-controlled JavaScript in the application origin.
6. Attacker abuses the victim's session to read accessible information, perform unauthorized actions, alter configuration, or prepare follow-on compromise of build or deployment workflows.

How to detect it

Investigate whether exploitation already occurred by reviewing TeamCity access logs, reverse proxy logs, WAF logs, SSO logs, and endpoint browser telemetry for requests to build-step copy functionality containing script-like input or encoded HTML/JavaScript. Focus on requests followed by privileged actions from the same user session, such as build configuration changes, build-step edits, token creation, unusual project administration actions, plugin changes, or unexpected build executions. Correlate suspicious requests with phishing reports, chat messages, issue tracker links, and referrer headers. Examine TeamCity audit logs for configuration changes made by users shortly after they accessed unusual URLs. Review browser security telemetry, EDR events, and proxy logs for outbound connections initiated from TeamCity pages to unfamiliar domains, which may indicate injected JavaScript exfiltration. Because reflected XSS often leaves no server-side file artifact, detection depends primarily on request logs, audit trails, user activity timelines, and suspicious encoded payloads in URLs or form parameters.

• <script
• %3Cscript
• </script>
• %3C%2Fscript%3E
• javascript:
• onerror=
• onload=
• onclick=
• document.cookie
• localStorage
• sessionStorage
• fetch(
• XMLHttpRequest
• eval(
• atob(
• new Image(
• img src=x
• svg/onload
• TeamCity
• Build Step

What your security team should do

• Prioritize upgrading TeamCity to 2023.05.3 or later, and upgrade org.infinispan/infinispan-server-rest to 15.0.0.Dev04 or later where that package is present and applicable.
• Inventory exposed CI/CD systems and restrict TeamCity administrative access from the public internet wherever possible.
• Review users with administrative or project-configuration privileges and enforce least privilege.
• Search web, proxy, WAF, and application logs for suspicious script-like parameters around build-step copy actions.
• Review recent TeamCity configuration changes, build-step modifications, plugin changes, token creation, and unusual build triggers for signs of abuse.
• Implement or strengthen Content Security Policy and secure cookie attributes to reduce XSS impact.
• Educate CI/CD administrators and developers not to open unsolicited links to internal build systems.
• If suspicious activity is found, rotate potentially exposed credentials, API tokens, webhook secrets, deploy keys, and build-service credentials.