JetBrains has reported a security incident involving a breach of its internal Cadence environment, which attackers exploited to extract AWS credentials. The incident, which occurred last month, leveraged a recently disclosed critical vulnerability in TeamCity, JetBrains' continuous integration and continuous delivery (CI/CD) server. The company is advising all Cadence users to revoke and rotate any credentials or secrets that may have been utilized in their Cadence executions.
The attack vector involved an unpatched instance of TeamCity, indicating that the attackers likely exploited a known, critical vulnerability for which a patch was available but not yet applied to the affected system. Critical vulnerabilities in CI/CD platforms like TeamCity are highly sought after by attackers due to the privileged access these systems often have to source code repositories, build artifacts, and deployment environments, including cloud infrastructure credentials.
Upon gaining access to the TeamCity instance, the threat actors were able to breach JetBrains' Cadence environment. Cadence is an open-source distributed fault-tolerant long-running process orchestration engine. In this context, it appears the attackers specifically targeted and successfully extracted AWS credentials. These credentials would typically grant programmatic access to various Amazon Web Services resources, potentially including compute instances, storage buckets, databases, and other cloud services.
The scope of the compromise, as indicated by JetBrains' advisory, primarily affects Cadence users who may have had their execution-related credentials exposed. This suggests that the extracted AWS credentials were tied to the operational aspects of Cadence workflows, potentially impacting users' ability to securely run and manage their distributed processes. The immediate recommendation to revoke and rotate credentials is a standard and critical first response to mitigate the risk of unauthorized access to cloud resources.
Mitigation for this class of incident typically involves a multi-pronged approach. Organizations are advised to ensure all software, especially critical infrastructure like CI/CD servers, is kept up-to-date with the latest security patches. Implementing robust network segmentation can limit the lateral movement of attackers even if an initial breach occurs. Furthermore, adopting the principle of least privilege for all credentials and regularly auditing access logs for unusual activity are essential security practices.
This incident underscores the persistent threat posed by unpatched vulnerabilities, particularly in core development infrastructure. CI/CD systems are high-value targets for adversaries due to their central role in software development and deployment pipelines, often holding keys to an organization's most sensitive assets, including cloud infrastructure. The prompt disclosure and mitigation advice from JetBrains highlight the importance of transparency and user action in the face of such breaches.
