JetBrains IDE Remote Code Execution and Local File Disclosure

Re:JetBrains IDE Remote Code Execution and Local File Disclo... by nucleardog on Monday August 15, 2016 @03:43PM (#12292885)

This is exactly why services that expose unnecessary network services drive me batty.

The extent of this vulnerability would have been significantly limited if it were only enabled for users using the feature (e.g., not Android Studio, PyCharm, or other users) and even more-so if it were enabled on-demand.

In recent memory, both CodeKit and Prepros really want to have some live preview HTTP server enabled all the time. Simply enabling it when the user hit the "Open Live Preview" button in the app would significantly reduce the attack surface. As would giving users the option to enable/disable it at will.

[ Parent | on HN ]

Re:JetBrains IDE Remote Code Execution and Local File Disclo... by alexhayes on Monday August 15, 2016 @05:29PM (#12293619)

FYI - WebStorm's features exist in PyCharm and you can count me as one user that finds them extremely useful.

I agree with the enabled on-demand comment however.

[ Parent | on HN ]

Re:JetBrains IDE Remote Code Execution and Local File Disclo... by nitrogen on Tuesday August 16, 2016 @04:45AM (#12296239)

Enabling it on demand would also allow them to randomize the listening port and generate new authentication tokens more frequently.

[ Parent | on HN ]