Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IntelliJ GitHub Plugin leaking credentials

blog.jetbrains.com

Post reply on HN
Print view View original

1–10 of 26 posts

Re: IntelliJ GitHub Plugin leaking credentials

#5

Post by refulgentis »

that_guy_iain wrote: post #2

This is the second time today I’ve seen this but it is dated the 10th how come it’s taken everyone so long to notice?

I don't understand what you mean: a blog post was published on the 10th, you saw a link to it twice today, so "everyone" took "so long to notice"?

I'm teasing, it's just a surprisingly increasing fallacy I see: "Why is the rate at which I saw things not the rate I expect? What did They mean by this?"

Re: IntelliJ GitHub Plugin leaking credentials

#6

Post by Merad »

It seems like GitHub is rejecting requests from affected IDE versions. We discovered this yesterday because PR integration was not working even though the GitHub login/token was correct. Issue resolved by upgrading the IDE to the latest version.

Re: IntelliJ GitHub Plugin leaking credentials

#7

Post by mattjaynes »

I have a client who was using JetBrains' TeamCity CI product. Was a clown show of vulnerabilities that allowed attackers access to internals.

Do not use their products. If you must for some reason, be sure you subscribe to critical CVEs of the products you are using and update them immediately and rotate your credentials. Ideally re-install on a fresh server. Never have the service available via the public web, it will be hacked - only use their products behind a VPN.

https://blog.jetbrains.com/teamcity/2024/02/critical-securit... https://blog.jetbrains.com/teamcity/2024/03/additional-criti...

Re: IntelliJ GitHub Plugin leaking credentials

#8

Post by rf15 »

mattjaynes wrote: post #7

I have a client who was using JetBrains' TeamCity CI product. Was a clown show of vulnerabilities that allowed attackers access to internals. Do not use their products. If you must for some reason, be sure you subscribe to critical CVEs of the products you are using and update them immediately and rotate your credentials. Ideally re-install on a fresh server. Never have the service available via the public web, it wi…

Their plugins are a (very) mixed bag, but saying to not use their products is a bit too alarmist if you ask me - the baseline IDE is doing fairly well, and teamcity and doing your GitHub-specific PR-stuff from within intelliJ is kind of niche overall I would assume (I've never used either, only the stock git client they have)
Post reply on HN