Executive Summary
A critical supply-chain breach has compromised JetBrains Cadence, an enterprise orchestration platform, following the exploitation of an unpatched TeamCity Continuous Integration and Continuous Deployment (CI/CD) server. Threat actors leveraged a high-severity authentication bypass vulnerability in TeamCity's web controller component to gain administrative footholds, traverse network boundaries, and extract active Amazon Web Services (AWS) Identity and Access Management (IAM) credentials and cloud tokens. The incident highlights the acute vulnerability of continuous deployment pipelines, where misconfigurations or delayed patch cycles on build automation nodes expose sensitive production environments to systemic supply-chain compromise.
Deep-Dive Technical Analysis
The breach unfolded through a coordinated sequence targeting JetBrains' build and orchestration nodes:
1. Authentication Bypass on CI/CD Controller: The initial entry vector involved an unpatched vulnerability within TeamCity's HTTP request-routing logic. By appending specific path manipulation strings and request headers to the administrative initialization endpoint (/admin/createAdminUser.html), unauthenticated attackers bypassed authentication filters, creating a rogue user profile with administrative rights.
2. Build Agent Hijacking & Pipeline Script Injection: With administrative access secured, the adversary modified existing build pipeline configurations. They injected malicious build steps into automated test suites, enabling the execution of arbitrary Bash scripts on dynamic build runners.
3. IAM Credential Scraping & Metadata Abuse:
* The build runners operated within an AWS virtual private cloud with an attached IAM instance profile.
* Attackers queried the Instance Metadata Service (IMDSv1) via http://169.254.169.254/latest/meta-data/iam/security-credentials/, extracting temporary STS security tokens with broad read/write permissions.
* The extracted credentials were encrypted and exfiltrated to external command-and-control (C2) servers via covert DNS tunneling to avoid egress firewall alarms.
4. Cadence Platform Infiltration: Using the harvested AWS credentials, the attackers moved laterally into JetBrains Cadence production clusters, accessing internal telemetry, pipeline metadata, and deployment secrets before incident response teams revoked the compromised tokens.
Industry Impact
The compromise of CI/CD infrastructure represents one of the highest-impact threat scenarios in modern DevSecOps:
* Blast Radius Across Client Environments: When an orchestration service or developer tool provider is compromised, attackers can potentially poison downstream software artifacts, release malicious builds, or pivot into private client infrastructure.
* Exposure of Ephemeral Secrets: Build runners frequently process sensitive environment variables—including database passwords, signing certificates, API keys, and cloud provider secrets—making them lucrative targets for espionage and extortion groups.
* Erosion of DevOps Trust: The breach reinforces the imperative that internal development tools require the same zero-trust isolation and immediate patching cadence as customer-facing production systems.
Recommendations & Mitigations
Organizations utilizing JetBrains TeamCity, Cadence, or similar CI/CD pipelines must take immediate defensive steps:
1. Apply Emergency Patches Immediately: Update all TeamCity on-premises servers and build agents to the latest vendor-provided security releases. Ensure external access to build controllers is restricted via VPN and reverse proxy authentication.
2. Enforce IMDSv2 Exclusively: Disable IMDSv1 across all AWS EC2 instances and build runners by setting HttpTokens=required with a hop limit of 1. This stops unauthorized SSRF-based metadata and credential theft.
3. Rotate Cloud Credentials & API Keys: Immediately invalidate and rotate all AWS IAM keys, service account secrets, and access tokens that were present on or accessible by build pipelines.
4. Isolate Build Environments & Enforce Least Privilege: Run CI/CD jobs in isolated, single-use ephemeral containers. Never attach long-lived or overly permissive IAM roles to build runner host instances.
5. Enable Secrets Masking & Real-Time Egress Monitoring: Implement static analysis and secrets scanning to prevent API keys from appearing in build logs, and monitor outbound runner traffic for anomalous data transfers or unauthorized DNS tunneling.