CVE-2025-58335
📋 TL;DR
This vulnerability in JetBrains Junie allows attackers to access sensitive information through the search_project function. It affects users running vulnerable versions of JetBrains Junie software. The information disclosure could expose internal project data or configuration details.
💻 Affected Systems
- JetBrains Junie
📦 What is this software?
Junie by Jetbrains
Junie by Jetbrains
Junie by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive project information, intellectual property, or configuration data that could facilitate further attacks.
Likely Case
Unauthorized access to project metadata, file structures, or limited configuration information that could aid in reconnaissance.
If Mitigated
Limited exposure of non-critical information with proper access controls and network segmentation in place.
🎯 Exploit Status
Exploitation requires access to the search_project function, which typically requires some level of access to the application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 or later
Vendor Advisory: https://www.jetbrains.com/privacy-security/issues-fixed/
Restart Required: Yes
Instructions:
1. Open JetBrains Junie. 2. Navigate to Help > Check for Updates. 3. Follow the update wizard to install the latest version. 4. Restart the application when prompted.
🔧 Temporary Workarounds
Disable search_project function
allTemporarily disable or restrict access to the search_project function if not essential for operations.
Network segmentation
allRestrict network access to JetBrains Junie instances to trusted users only.
🧯 If You Can't Patch
- Implement strict access controls to limit who can use the search_project function
- Monitor for unusual search activity or information access patterns
🔍 How to Verify
Check if Vulnerable:
Check the Junie version in Help > About. Compare against affected version list.Check Version:
In Junie: Help > AboutVerify Fix Applied:
Verify version is updated to one of the patched versions listed in the fix section.📡 Detection & Monitoring
Log Indicators:
- Unusual search_project function usage patterns
- Multiple failed or unusual search attempts
Network Indicators:
- Unusual traffic to search_project endpoints
- Repeated search requests from single sources
SIEM Query:
source="junie" AND (event="search_project" OR event="search") AND result="success" | stats count by src_ip