IntelliJ GitHub Plugin leaking credentials • Hacker News Board

Re: IntelliJ GitHub Plugin leaking credentials

#11

Post by mattjaynes » Thu, Jun 13, 2024, 10:16 PM UTC

rf15 wrote: post #8

mattjaynes wrote: post #7

I have a client who was using JetBrains' TeamCity CI product. Was a clown show of vulnerabilities that allowed attackers access to internals. Do not use their products. If you must for some reason, be sure you subscribe to critical CVEs of the products you are using and update them immediately and rotate your credentials. Ideally re-install on a fresh server. Never have the service available via the public web, it wi…

Their plugins are a (very) mixed bag, but saying to not use their products is a bit too alarmist if you ask me - the baseline IDE is doing fairly well, and teamcity and doing your GitHub-specific PR-stuff from within intelliJ is kind of niche overall I would assume (I've never used either, only the stock git client they have)

That's fair. I have limited experience with the rest of their offerings. They only came onto my radar because of regular critical CVEs that needed urgent fixing. The communication from the company had no hint of apology - just "hey, better fix this before your server is p0wned" - which did not seem like they were to be taken seriously.

Re: IntelliJ GitHub Plugin leaking credentials

#12

Post by lostmsu » Thu, Jun 13, 2024, 10:29 PM UTC

orf wrote: post #9

What is the actual vulnerability? The post is super light on details.

Sounds like they added token to all requests done by the plugin, so when you opened a pull request and linked an image from 3rd party, the 3rd party would receive your token.

Re: IntelliJ GitHub Plugin leaking credentials

#13

Post by manquer » Fri, Jun 14, 2024, 12:08 AM UTC

mattjaynes wrote: post #7

I have a client who was using JetBrains' TeamCity CI product. Was a clown show of vulnerabilities that allowed attackers access to internals. Do not use their products. If you must for some reason, be sure you subscribe to critical CVEs of the products you are using and update them immediately and rotate your credentials. Ideally re-install on a fresh server. Never have the service available via the public web, it wi…

Android Studio is built on IntelliJ platform, this is not a choice a developer always can make

—-

P.S. yes it is possible to develop Android apps without studio, but it is painful to setup and manage , developers should not be fighting the system to do their jobs

Re: IntelliJ GitHub Plugin leaking credentials

#14

Post by manquer » Fri, Jun 14, 2024, 12:12 AM UTC

that_guy_iain wrote: post #2

This is the second time today I’ve seen this but it is dated the 10th how come it’s taken everyone so long to notice?

It didnt ? I have got three different advisories from infosec this week, even customers have asked about it

Re: IntelliJ GitHub Plugin leaking credentials

#15

Post by thund » Fri, Jun 14, 2024, 12:22 AM UTC

stuff4ben wrote: post #4

Good idea to rotate your tokens on a regular basis, but in this case, go ahead and do it now (if you use this tool and plugin)

better even, don’t use never-expiring tokens/credentials that need rotation.

Re: IntelliJ GitHub Plugin leaking credentials

#16

Post by that_guy_iain » Fri, Jun 14, 2024, 2:28 AM UTC

refulgentis wrote: post #5

that_guy_iain wrote: post #2

This is the second time today I’ve seen this but it is dated the 10th how come it’s taken everyone so long to notice?

I don't understand what you mean: a blog post was published on the 10th, you saw a link to it twice today, so "everyone" took "so long to notice"? I'm teasing, it's just a surprisingly increasing fallacy I see: "Why is the rate at which I saw things not the rate I expect? What did They mean by this?"

Well considering the amount I’m on here, Reddit, and various tech slacks seeing something like this repeatedly normally means it’s just been posted. I’m kinda wondering if they didn’t do the usual promotion.

Re: IntelliJ GitHub Plugin leaking credentials

#17

Post by albert_e » Fri, Jun 14, 2024, 4:54 AM UTC

Off topic -- how does the JetBrains website display "IntelliJ" text in stylized "iJ" at the end of IntelliJ? Some CSS magic?

I tried editing the text using the developer tools and this styling only applies when the text is IntelliJ or any word that starts with this exact string (case sensitive)

Re: IntelliJ GitHub Plugin leaking credentials

#18

Post by yen223 » Fri, Jun 14, 2024, 4:57 AM UTC

albert_e wrote: post #17

Off topic -- how does the JetBrains website display "IntelliJ" text in stylized "iJ" at the end of IntelliJ? Some CSS magic? I tried editing the text using the developer tools and this styling only applies when the text is IntelliJ or any word that starts with this exact string (case sensitive)

That effect comes from their font - "Jetbrain Sans"

Re: IntelliJ GitHub Plugin leaking credentials

#19

Post by muningis » Fri, Jun 14, 2024, 5:06 AM UTC

albert_e wrote: post #17

Off topic -- how does the JetBrains website display "IntelliJ" text in stylized "iJ" at the end of IntelliJ? Some CSS magic? I tried editing the text using the developer tools and this styling only applies when the text is IntelliJ or any word that starts with this exact string (case sensitive)

That’s font ligature. Basically when two glyphs/symbols are one after another, they have a different glyph to show both of them.

Re: IntelliJ GitHub Plugin leaking credentials

#20

Post by raincole » Fri, Jun 14, 2024, 5:21 AM UTC

albert_e wrote: post #17

Off topic -- how does the JetBrains website display "IntelliJ" text in stylized "iJ" at the end of IntelliJ? Some CSS magic? I tried editing the text using the developer tools and this styling only applies when the text is IntelliJ or any word that starts with this exact string (case sensitive)

Have you seen whose weird "fonts for programmers" that make != look like a single character? Same thing.

(Btw I hate that)