Coder vulnerabilities

In Coder prior to versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, the `azureidentity.Validate()` function does not verify the PKCS#7 signature, only checking that the signer certificate chains to a trusted Azure CA. An attacker can embed a legitimate Azure certificate alongside arbitrary content, e.g., `{"vmId":"<target>"}`, and the forged `vmId` will be accepted, returning the victim workspace agent's session token.

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.

Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypass per-IP rate limits on login, one-time passcode, and password validation endpoints, enabling brute-force attacks, and to falsify IP addresses recorded in audit logs.

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users.

Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing.

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint to harvest group members' emails, login types, status, and last-seen and creation timestamps.

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets.

Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from an organization can keep accessing previously granted org-scoped resources such as templates and workspaces via the API.

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this endpoint to read credentials such as cloud keys or registry tokens.

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization.

Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing.

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient() follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API port 4. An authenticated user who controls a modified workspace agent and knows another online agent's UUID can derive the victim's tailnet address and redirect control-plane requests to that agent. HTTP 301, 302, and 303 redirects can redirect read requests, while HTTP 307 and 308 preserve replayable write and process-start requests. The redirected workspace agent file APIs can read or write files as the victim workspace user, and affected versions exposing the workspace agent process API can execute commands after a redirected file write, crossing workspace and tenant boundaries. This issue is fixed in versions 2.29.19, 2.32.9, 2.33.10, and 2.34.4.

In Coder prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the subdomain-based workspace app proxy allowed bypassing the same-owner CORS check. When a workspace-name subdomain segment parsed as a UUID, the workspace was resolved by ID without verifying the URL's username matched the real owner, while the CORS middleware trusted the unverified username in the hostname.

In Coder prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine` dashboard component used `ansi-to-html` without `escapeXML: true` and inserted the result via `dangerouslySetInnerHTML`, causing HTML embedded in agent logs to be rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters.

In Coder from version 2.30.0 to 2.32.7, 2.33.8, and 2.34.2, the AI Bridge Proxy (`aibridgeproxyd`) created a goproxy server whose default transport set `InsecureSkipVerify: true`, accepting any TLS certificate for outbound HTTPS to the Coder access URL. This allows man-in-the-middle attacks.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer recreate endpoint only checked `ActionRead` on the workspace, missing an `ActionUpdate` check before triggering a destructive rebuild. An attacker with low privileges and workspace access could exploit this for unauthorized rebuilds.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `CreateSubAgent` RPC did not validate a requested app sharing level against the template's `MaxPortSharingLevel` before persisting workspace apps, letting a workspace owner exceed the administrator's configured maximum.

A vulnerability in Coder CLI allows session token theft by opening a malicious workspace app URL. An attacker (template author) can configure an external workspace app that, when `coder open app` is executed, substitutes the session token in the URL and opens it in the victim's browser.

A vulnerability in Coder allows an attacker to redirect traffic from the workspace app proxy to an arbitrary host via the X-Forwarded-Host header. The issue occurs when subdomain app routing (wildcard hostname) is enabled, a victim visits the attacker's shared app, and the upstream proxy does not strip this header.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `UpsertWorkspaceApp` overwrites an existing app entry and `insertAgentApp` accepts the app ID from the `CompleteJob` payload without verifying it belongs to the workspace being built. This allows cross-workspace agent reassignment, requiring elevated privileges of a template author or external provisioner operator.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator does not validate the AllowedIPs field supplied by agents, allowing an agent to spoof another UUID and intercept network traffic. This vulnerability lets unauthorized agents inject arbitrary routes into WireGuard peer configurations, potentially enabling man-in-the-middle attacks.

A vulnerability in Coder allows injection of arbitrary SSH configuration into the user's ~/.ssh/config via unsanitized HostnameSuffix and SSHConfigOptions values supplied by the server. Exploitation requires control over the Coder server (malicious deployment, MITM attack, or admin access).

A vulnerability in Coder allows an attacker to send a DataUpload request with an inflated FileSize value, causing excessive memory allocation and potential resource exhaustion. Affected versions are 2.24.0 through 2.29.6, 2.32.6, 2.33.7, and 2.34.1.

A vulnerability in Coder allows a denial-of-service (DoS) attack by uploading a crafted ZIP archive that, when converted to TAR in memory, has no aggregate limit on decompressed output. Exploitation requires authentication and file-upload access.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `PUT /api/v2/users/{user}/password` endpoint only authorized `ActionUpdatePersonal` and did not prevent a `user-admin` from resetting an `owner` account's password. It also did not require the current password when an admin reset another user's password.

In Coder before versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the OIDC callback validation of `email_verified` was vulnerable due to a direct Go bool type assertion. When an IdP returned the claim as a non-boolean (e.g., string "false") or omitted it, the assertion failed open, treating the email as verified. Combined with an unconditional email-based account fallback, this enabled account takeover.

In Coder before versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in the OIDC login mechanism chain into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject, and the `email_verified` claim was only enforced when present as a boolean `false`, so an absent or non-boolean claim was treated as verified.

Coder versions prior to 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind SSRF via the Azure instance identity endpoint. An external attacker can force the Coder server to issue HTTP GET requests to arbitrary hosts by sending a crafted PKCS#7 signature.

In Coder from version 2.33.0 to 2.33.8 and 2.34.2, AI Bridge provider handlers read request bodies with `io.ReadAll` without a maximum size, allowing an authenticated user with AI Bridge access to send an arbitrarily large body and exhaust memory. The vulnerability leads to denial of service (DoS).

In Coder before versions 2.29.7 and 2.30.2, the `dotfiles` registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. An attacker could supply a crafted `dotfiles_uri` (e.g., containing shell command substitution like `$(...)`) to achieve command execution in their own workspace. The Create Workspace page's `mode=auto` deep links amplified this into a one-click attack without user confirmation.

A vulnerability in Coder allows suspended users to continue using valid API keys until they are deleted. The AI Bridge proxy authentication does not check if the account is suspended, enabling unauthorized access.

In Coder versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, insecure session handling in prebuilt workspaces allows compromise. The session token for the prebuilds user is not expired after a workspace is claimed, potentially leading to account takeover if workspace templates persist this token.