Description

In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-11-06T17:17:23.130Z",
  "pubdate": "2026-11-06T17:17:23.130Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in JetBrains IntelliJ IDEA versions prior to 2026.3. The flaw exists within the application's handling of custom plugin repository configurations.\nBy coercing the application to process a controlled custom repository URL, an attacker can force the host system running JetBrains IntelliJ IDEA to issue arbitrary outbound network requests.\nThe primary impact includes network reconnaissance against internal infrastructures, unauthorized interaction with internal services or local loopback interfaces, and potential exposure of sensitive data from local resources or cloud metadata services. This poses severe risk to enterprise environments where developer workstations have privileged access to internal networks.\nExploitation typically requires the capability to specify or supply a custom plugin repository endpoint, either through direct user interaction, malicious configuration files, or social engineering techniques targeting developer workflows.",
  "technicalDetails": "The root cause of this vulnerability lies in insufficient input validation and host verification when JetBrains IntelliJ IDEA processes network requests for custom plugin repositories. When a custom repository URL is registered within the application settings, the internal HTTP client retrieves manifest files and plugin metadata directly from the defined location.\nDue to inadequate restriction of destination hosts, protocol schemes, and network target ranges, the application treats attacker-controlled URLs as valid resource endpoints without enforcing strict destination boundaries.\nThe attack flow proceeds in several distinct stages:\n1. Repository Configuration: An attacker provides a crafted custom plugin repository URL, either by persuading a user to manually add the repository URL within the settings menu or by distributing an infected project/IDE settings configuration file.\n2. Request Triggering: When JetBrains IntelliJ IDEA initiates an automatic update check, refreshes repository indexes, or syncs plugin configurations, the underlying fetching mechanism resolves the custom repository URL.\n3. Out-of-Band Request Execution: The application generates an HTTP or HTTPS request from the context of the host workstation directly to the specified target address. This bypasses typical network access boundaries and firewalls that restrict external access to internal infrastructure.\n4. Target Exploitation: If pointed at internal loopback addresses (e.g., 127.0.0.1 or localhost), RFC 1918 private subnets, or non-routable link-local endpoints (such as cloud metadata services like 169.254.169.254), the application acts as a proxy. The attacker can potentially map internal open ports, interact with unprotected local services, or exfiltrate metadata tokens and sensitive environment data depending on how errors and responses are handled by the repository manager.\nThis vulnerability specifically affects all releases of JetBrains IntelliJ IDEA before version 2026.3. The exposure depends heavily on the privilege context of the developer environment and the network visibility of the host running the vulnerable IDE software."
}