CVE-2024-37051: JetBrains Aqua Token Disclosure Flaw

CVE-2024-37051 Overview

CVE-2024-37051 is a sensitive data exposure vulnerability affecting the entire JetBrains IDE product family released after version 2023.1. The vulnerability allows GitHub access tokens to be exposed to third-party sites, potentially enabling unauthorized access to developers' GitHub repositories, organizations, and associated resources. This security flaw falls under CWE-522 (Insufficiently Protected Credentials) and represents a significant risk to software development environments.

Critical Impact

GitHub access tokens configured in affected JetBrains IDEs could be leaked to malicious third-party websites, potentially compromising source code repositories, CI/CD pipelines, and organizational GitHub resources.

Affected Products

• JetBrains IntelliJ IDEA (versions 2023.1 through 2023.1.6, 2023.2 through 2023.2.6, 2023.3 through 2023.3.6, 2024.1 through 2024.1.2)
• JetBrains PyCharm (versions 2023.1 through 2023.1.5, 2023.2 through 2023.2.6, 2023.3 through 2023.3.5, 2024.1 through 2024.1.2)
• JetBrains WebStorm (versions 2023.1 through 2023.1.5, 2023.2 through 2023.2.6, 2023.3 through 2023.3.6, 2024.1 through 2024.1.3)
• JetBrains CLion (versions 2023.1 through 2023.1.6, 2023.2 through 2023.2.3, 2023.3 through 2023.3.4, 2024.1 through 2024.1.2)
• JetBrains GoLand (versions 2023.1 through 2023.1.5, 2023.2 through 2023.2.6, 2023.3 through 2023.3.6, 2024.1 through 2024.1.2)
• JetBrains PhpStorm (versions 2023.1 through 2023.1.5, 2023.2 through 2023.2.5, 2023.3 through 2023.3.6, 2024.1 through 2024.1.2)
• JetBrains Rider (versions 2023.1 through 2023.1.6, 2023.2 through 2023.2.4, 2023.3 through 2023.3.5, 2024.1 through 2024.1.2)
• JetBrains RubyMine (versions 2023.1 through 2023.1.6, 2023.2 through 2023.2.6, 2023.3 through 2023.3.6, 2024.1 through 2024.1.2)
• JetBrains DataGrip (versions 2023.1 through 2023.1.2, 2023.2 through 2023.2.3, 2023.3 through 2023.3.4, 2024.1 through 2024.1.3)
• JetBrains DataSpell (versions 2023.1 through 2023.1.5, 2023.2 through 2023.2.6, 2023.3 through 2023.3.5, 2024.1 through 2024.1.1)
• JetBrains Aqua (versions prior to 2024.1.2)
• JetBrains RustRover (versions prior to 2024.1.1)
• JetBrains MPS (versions 2023.2 through 2023.2.0, 2023.3.0, and early 2024.1 releases)

Discovery Timeline

• June 10, 2024 - CVE-2024-37051 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-37051

Vulnerability Analysis

This vulnerability represents an insufficiently protected credentials issue within JetBrains IDE products when handling GitHub integration. The flaw exists in how the IDEs manage and transmit GitHub access tokens during certain operations, potentially allowing these tokens to be exposed to third-party websites.

GitHub access tokens are OAuth tokens that provide authenticated access to GitHub APIs and repositories. When exposed, these tokens can grant attackers the same level of access as the legitimate user, including read and write access to private repositories, organization settings, and other sensitive resources depending on the token's scope.

The vulnerability affects the entire JetBrains IDE ecosystem, spanning 13 different products across multiple version branches, indicating the vulnerable component is part of the shared codebase used for GitHub integration across all JetBrains IDEs.

Root Cause

The root cause of CVE-2024-37051 stems from improper credential handling in the GitHub integration plugin component shared across JetBrains IDE products. The vulnerability is classified under CWE-522 (Insufficiently Protected Credentials), indicating that the mechanism for storing or transmitting GitHub access tokens failed to adequately protect these sensitive credentials from exposure to external parties.

The issue specifically manifests when the IDE interacts with web content or third-party sites in a manner that inadvertently includes or exposes the configured GitHub access token. This could occur through improper request handling, inadequate isolation between trusted and untrusted contexts, or insufficient validation of request destinations before including authentication credentials.

Attack Vector

The attack vector for this vulnerability is network-based and requires no user authentication or privileges to exploit. An attacker could potentially exploit this vulnerability by:

1. Hosting a malicious website or compromising a legitimate site that developers might visit
2. Crafting content that triggers the IDE to make requests that include the GitHub access token
3. Capturing the exposed token from these requests
4. Using the stolen token to access the victim's GitHub resources

The vulnerability can be exploited remotely without requiring any special privileges or user interaction beyond normal IDE usage. Once an attacker obtains a valid GitHub access token, they can perform any actions permitted by the token's scope, including accessing private repositories, modifying code, managing organization settings, or exfiltrating sensitive source code.

Detection Methods for CVE-2024-37051

Indicators of Compromise

• Unexpected GitHub API activity from unfamiliar IP addresses or geographic locations
• Unusual repository access patterns, such as bulk cloning of private repositories
• GitHub audit logs showing API calls from unknown client applications
• Reports of unauthorized commits or repository modifications
• New SSH keys or personal access tokens appearing in GitHub account settings

Detection Strategies

• Monitor GitHub organization audit logs for suspicious API activity and unusual access patterns
• Review GitHub security alerts and access logs for tokens associated with JetBrains IDE integrations
• Implement alerting on GitHub API usage from unexpected IP addresses or user agents
• Check for unauthorized repository access or data exfiltration in GitHub activity feeds

Monitoring Recommendations

• Enable comprehensive GitHub audit logging at the organization level
• Configure alerts for new OAuth token authorizations and personal access token creation
• Monitor network traffic from developer workstations for unusual outbound connections
• Implement SIEM rules to correlate JetBrains IDE activity with GitHub API access patterns

How to Mitigate CVE-2024-37051

Immediate Actions Required

• Update all affected JetBrains IDE products to the latest patched versions immediately
• Revoke and regenerate all GitHub access tokens that were configured in vulnerable IDE versions
• Audit GitHub organization and repository access logs for any suspicious activity during the exposure window
• Review and rotate any secrets or credentials stored in repositories that may have been accessed

Patch Information

JetBrains has released security patches for all affected IDE products. Organizations should update to the following minimum versions:

• IntelliJ IDEA: 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, or 2024.2 EAP3
• PyCharm: 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, or 2024.2 EAP2
• WebStorm: 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4
• CLion: 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, or 2024.2 EAP2
• GoLand: 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, or 2024.2 EAP3
• PhpStorm: 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, or 2024.2 EAP3
• Rider: 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3
• RubyMine: 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, or 2024.2 EAP4
• DataGrip: 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4
• DataSpell: 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, or 2024.2 EAP1
• Aqua: 2024.1.2
• RustRover: 2024.1.1
• MPS: 2023.2.1, 2023.3.1, or 2024.1 EAP2

For detailed patch information, refer to the JetBrains Privacy and Security Updates page. Additional security advisory information is available from NetApp Security Advisory NTAP-20240705-0004.

Workarounds

• Temporarily disable GitHub integration in JetBrains IDEs until patches can be applied
• Use SSH-based GitHub authentication instead of token-based authentication where possible
• Implement network-level controls to restrict outbound connections from developer workstations
• Configure GitHub tokens with minimal required scopes to limit potential exposure impact

# Verify JetBrains IDE version and check for updates
# Navigate to Help > About in your IDE to check current version
# Or use the Toolbox App to manage updates across all JetBrains products

# Revoke potentially compromised GitHub tokens via GitHub CLI
gh auth logout
gh auth login --web

# List and revoke OAuth authorizations from command line
gh api /applications/{client_id}/grant -X DELETE

# Generate new GitHub personal access token with minimal scopes
gh auth refresh --scopes repo,read:org