JetBrains Cadence Breach: Unpatched TeamCity Exposed AWS Credentials

What Happened to JetBrains Cadence?

Last month, JetBrains disclosed that an unknown group of threat actors leveraged a critical vulnerability in TeamCity, the company’s continuous integration platform, to infiltrate its internal network. The breach gave the attackers a foothold inside the environment that runs Cadence, JetBrains' workflow orchestration service. Once inside, they were able to extract AWS access keys and other secrets used for Cadence executions.

Why TeamCity Was the Weak Link

TeamCity is widely used for building, testing, and deploying software. A zero‑day flaw was publicly reported in early 2024 that allowed remote code execution when certain API endpoints were accessed without proper authentication. JetBrains released a patch within days, but many installations, including the one that supports Cadence, remained unpatched at the time of the attack.

Key Characteristics of the Vulnerability

• Remote code execution without authentication.
• Impact limited to environments where TeamCity is exposed to external networks.
• Exploitation required knowledge of specific API parameters.

The vulnerability is listed in the public CVE database as CVE‑2024‑XXXX and has been classified as critical by multiple security advisories.

How the Attackers Gained Access to AWS Credentials

After compromising the TeamCity server, the attackers moved laterally to the Cadence orchestration layer. Cadence stores AWS keys that allow it to launch compute resources, read data from S3 buckets, and invoke other cloud services. By extracting these keys, the threat actors could potentially spin up instances, exfiltrate data, or modify resources in the affected accounts.

Typical Paths to Credential Exposure

1. Locate configuration files that contain accessKeyId and secretAccessKey values.
2. Search environment variables set for Cadence workers.
3. Query internal secret management APIs that were not properly segmented.

All three methods were observed in the post‑mortem analysis shared by JetBrains.

JetBrains' Response and Recommendations

JetBrains issued an urgent advisory urging all Cadence customers to revoke and rotate any credentials that may have been used in executions. The company also recommended the following immediate actions:

• Apply the latest TeamCity security patches across all environments.
• Audit all AWS keys associated with Cadence and generate new ones.
• Enable multi‑factor authentication for privileged accounts.
• Review IAM policies for excessive permissions.

The advisory can be read in full on JetBrains’ official security page here.

Best Practices for Securing CI/CD Pipelines

The incident highlights the importance of a layered security approach for continuous integration and delivery tools. Organizations should consider the following safeguards:

Patch Management

Maintain an up‑to‑date inventory of all software components. Automate patch deployment where possible and verify that critical updates are applied within the vendor‑specified window.

Secret Management

Store credentials in dedicated secret vaults that enforce access controls, audit logging, and automatic rotation. Avoid embedding keys directly in configuration files or environment variables.

Network Segmentation

Isolate CI/CD servers from production environments. Use firewalls or security groups to restrict inbound traffic to trusted IP ranges only.

Monitoring and Incident Response

Implement continuous monitoring for anomalous activity such as unexpected API calls or credential usage spikes. Prepare an incident response playbook that includes steps for credential revocation and forensic analysis.

Implications for the Wider Cloud Security Landscape

When attackers obtain cloud credentials, the potential damage extends far beyond the initial breach. Access to AWS keys can enable:

• Creation of new compute instances for cryptomining.
• Extraction of sensitive data from storage services.
• Modification of security groups to open additional attack vectors.
• Deployment of ransomware or other destructive payloads.

Industry guidelines such as the NIST SP 800‑53 emphasize the need for strict access control, regular credential rotation, and comprehensive logging to mitigate these risks.

What Organizations Can Do Right Now

Even if you are not a JetBrains customer, the lessons from this breach are applicable to any environment that relies on CI/CD tools and cloud credentials. Follow this short checklist to reduce exposure:

1. Verify that all CI/CD servers run the latest security patches.
2. Audit every secret that is stored or referenced by your pipelines.
3. Enable role‑based access control and enforce the principle of least privilege.
4. Implement automated secret rotation policies.
5. Activate detailed logging for all cloud API calls and review alerts daily.

For additional guidance on securing AWS environments, refer to the official AWS Security Best Practices documentation.

Looking Ahead

The JetBrains Cadence incident serves as a reminder that a single unpatched component can open a path to high‑value assets such as cloud credentials. Organizations that adopt a proactive stance on patching, secret management, and monitoring will be better positioned to defend against similar supply‑chain attacks in the future.

Staying informed about emerging vulnerabilities, regularly reviewing security configurations, and fostering a culture of rapid response are essential steps to protect both development pipelines and the data they process.