Critical JetBrains Data Breach Exposes GitHub Tokens

Executive Summary

In May 2024, a critical vulnerability (CVE-2024-37051) was discovered in JetBrains’ GitHub plugin for IntelliJ-based IDEs, impacting versions from 2023.1 onwards. This vulnerability, with a CVSS score of 9.3, allowed malicious third parties to exploit GitHub access tokens through malicious pull requests. As a result, unauthorized access to GitHub repositories became a significant risk for organizations and developers alike. The breach was reported on May 29, 2024, prompting immediate investigation and remediation efforts by JetBrains. Users were advised to revoke compromised tokens and update their software to mitigate ongoing threats.

 Read the full breach analysis from NHI Mgmt Group here

Key Details

Breach Timeline

• May 29, 2024: JetBrains received an external security report detailing the vulnerability in the GitHub plugin.
• June 10, 2024: JetBrains initiated an investigation and began coordinating with GitHub to address the risks.
• June 12, 2024: Updated versions of the IDEs and plugins were released; users were advised to revoke compromised tokens.

Data Compromised

• The breach primarily exposed GitHub access tokens, which could grant unauthorized access to private repositories.
• Developers using affected versions of IntelliJ-based IDEs were significantly impacted, risking project confidentiality.

Impact Assessment

• The vulnerability posed a substantial risk to organizations relying on JetBrains tools for software development.
• Potential data breaches could lead to financial loss and reputational damage for affected parties.

Company Response

• JetBrains acted promptly by releasing patches and updates to remediate the vulnerability.
• Advisories were published guiding users on revoking compromised tokens and securing their GitHub accounts.

Security Implications

• This incident highlights the importance of monitoring third-party plugins and dependencies in software development.
• Organizations are advised to implement strict security protocols to manage token and API key exposure.

 If you want to learn more about how to secure NHIs including AI Agents, check our NHI Foundational Training Course.