Threat Intelligence Database

Coder versions from 2.10.0 up to but not including 2.34.8 contain an unauthenticated debug HTTP server listening on localhost (127.0.0.1) port 2113. The /debug/manifest endpoint exposes the full agent manifest, including environment variables provided by templates. This allows a lower-privileged Unix user or process within the same workspace to access sensitive credentials such as cloud keys or registry tokens. The vulnerability has a medium severity rating with a CVSS score of 3.3.

Coder versions before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 have an improper hostname validation vulnerability. The flaw is in the GetWorkspaceProxyByHostname function, where a SIMILAR TO pattern performs a prefix match, causing any domain that is a string prefix of a workspace-proxy access URL to be trusted as a proxy. This allows attackers controlling such a domain to trick authenticated users into visiting a crafted URL, capture their application_connect API key, and replay it to access the victim's workspace applications.

Coder versions from 2.0.0 up to but not including 2.34.8 have an authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego. This flaw allows authenticated users who have been removed from an organization to retain access to organization-scoped resources such as templates and workspaces via the API. The vulnerability arises because the acl_allow rule does not verify organization membership for per-user ACL entries, and removal from the organization does not clear those entries.

Coder versions from 2.30.0 up to but not including 2.34.8 have an authorization bypass vulnerability in the provisioner daemon's DownloadFile gRPC handler. This flaw allows authenticated provisioner daemons with an organization-scoped key and knowledge of a file UUID to download cached Terraform module archives belonging to other organizations. The exposure of these module archives can reveal sensitive infrastructure details or embedded secrets. The vulnerability has a medium severity rating with a CVSS score of 5.3.

Coder versions before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contain a stored HTML injection vulnerability. This occurs because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can inject HTML markup that is displayed in the Coder dashboard and in SMTP notification emails sent to other users. The vulnerability has a medium severity with a CVSS score of 3.4.

Coder versions from 2.0.0 up to but not including 2.34.8 contain an open redirect vulnerability in the handleAPIKeySmuggling function. This flaw allows attackers to craft URLs on trusted workspace app subdomains with paths starting with double slashes, causing scheme-relative redirects to attacker-controlled sites. Such redirects can be exploited for phishing attacks by misleading users to malicious external sites.

Coder versions from 2.26.0 up to but not including 2.34.8 have an authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint. This flaw allows authenticated users with workspace use access to retrieve group members' emails, login types, status, and timestamps by exploiting insufficient authorization checks. The vulnerability does not impact integrity or availability but exposes some sensitive information.

Coder versions before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 have a user enumeration vulnerability. This occurs because the function userpassword.Compare() uses a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Attackers can exploit this by submitting logins with the password "hunter2" and observing different HTTP response codes (403 vs 401) to identify valid user accounts and reveal the authentication provider for SSO-only users. The vulnerability has a CVSS score of 3.7, indicating medium severity.

Coder versions before 2.34.7 have an IP spoofing vulnerability in the ExtractRealIPAddress middleware. This middleware incorrectly trusts the leftmost client-supplied X-Forwarded-For header value instead of the client IP appended by a reverse proxy. Attackers can exploit this to bypass per-IP rate limits on login and authentication endpoints, enabling brute-force attacks and falsifying IP addresses in audit logs.

Coder versions 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contain an open redirect vulnerability in the login page. This occurs because the redirect query parameter is not properly sanitized, allowing attackers to craft login URLs that redirect users to malicious websites. The vulnerability has a medium severity rating with a CVSS score of 4.3.