Coder vulnerabilities

In Coder prior to versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, the `azureidentity.Validate()` function does not verify the PKCS#7 signature, only checking that the signer certificate chains to a trusted Azure CA. An attacker can embed a legitimate Azure certificate alongside arbitrary content, e.g., `{"vmId":"<target>"}`, and the forged `vmId` will be accepted, returning the victim workspace agent's session token.

In Coder prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the subdomain-based workspace app proxy allowed bypassing the same-owner CORS check. When a workspace-name subdomain segment parsed as a UUID, the workspace was resolved by ID without verifying the URL's username matched the real owner, while the CORS middleware trusted the unverified username in the hostname.

In Coder prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine` dashboard component used `ansi-to-html` without `escapeXML: true` and inserted the result via `dangerouslySetInnerHTML`, causing HTML embedded in agent logs to be rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters.

In Coder from version 2.30.0 to 2.32.7, 2.33.8, and 2.34.2, the AI Bridge Proxy (`aibridgeproxyd`) created a goproxy server whose default transport set `InsecureSkipVerify: true`, accepting any TLS certificate for outbound HTTPS to the Coder access URL. This allows man-in-the-middle attacks.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer recreate endpoint only checked `ActionRead` on the workspace, missing an `ActionUpdate` check before triggering a destructive rebuild. An attacker with low privileges and workspace access could exploit this for unauthorized rebuilds.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `CreateSubAgent` RPC did not validate a requested app sharing level against the template's `MaxPortSharingLevel` before persisting workspace apps, letting a workspace owner exceed the administrator's configured maximum.

A vulnerability in Coder CLI allows session token theft by opening a malicious workspace app URL. An attacker (template author) can configure an external workspace app that, when `coder open app` is executed, substitutes the session token in the URL and opens it in the victim's browser.

A vulnerability in Coder allows an attacker to redirect traffic from the workspace app proxy to an arbitrary host via the X-Forwarded-Host header. The issue occurs when subdomain app routing (wildcard hostname) is enabled, a victim visits the attacker's shared app, and the upstream proxy does not strip this header.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `UpsertWorkspaceApp` overwrites an existing app entry and `insertAgentApp` accepts the app ID from the `CompleteJob` payload without verifying it belongs to the workspace being built. This allows cross-workspace agent reassignment, requiring elevated privileges of a template author or external provisioner operator.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator does not validate the AllowedIPs field supplied by agents, allowing an agent to spoof another UUID and intercept network traffic. This vulnerability lets unauthorized agents inject arbitrary routes into WireGuard peer configurations, potentially enabling man-in-the-middle attacks.

A vulnerability in Coder allows injection of arbitrary SSH configuration into the user's ~/.ssh/config via unsanitized HostnameSuffix and SSHConfigOptions values supplied by the server. Exploitation requires control over the Coder server (malicious deployment, MITM attack, or admin access).

A vulnerability in Coder allows an attacker to send a DataUpload request with an inflated FileSize value, causing excessive memory allocation and potential resource exhaustion. Affected versions are 2.24.0 through 2.29.6, 2.32.6, 2.33.7, and 2.34.1.

A vulnerability in Coder allows a denial-of-service (DoS) attack by uploading a crafted ZIP archive that, when converted to TAR in memory, has no aggregate limit on decompressed output. Exploitation requires authentication and file-upload access.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `PUT /api/v2/users/{user}/password` endpoint only authorized `ActionUpdatePersonal` and did not prevent a `user-admin` from resetting an `owner` account's password. It also did not require the current password when an admin reset another user's password.

In Coder before versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the OIDC callback validation of `email_verified` was vulnerable due to a direct Go bool type assertion. When an IdP returned the claim as a non-boolean (e.g., string "false") or omitted it, the assertion failed open, treating the email as verified. Combined with an unconditional email-based account fallback, this enabled account takeover.

In Coder before versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in the OIDC login mechanism chain into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject, and the `email_verified` claim was only enforced when present as a boolean `false`, so an absent or non-boolean claim was treated as verified.

Coder versions prior to 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind SSRF via the Azure instance identity endpoint. An external attacker can force the Coder server to issue HTTP GET requests to arbitrary hosts by sending a crafted PKCS#7 signature.

In Coder from version 2.33.0 to 2.33.8 and 2.34.2, AI Bridge provider handlers read request bodies with `io.ReadAll` without a maximum size, allowing an authenticated user with AI Bridge access to send an arbitrarily large body and exhaust memory. The vulnerability leads to denial of service (DoS).

In Coder before versions 2.29.7 and 2.30.2, the `dotfiles` registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. An attacker could supply a crafted `dotfiles_uri` (e.g., containing shell command substitution like `$(...)`) to achieve command execution in their own workspace. The Create Workspace page's `mode=auto` deep links amplified this into a one-click attack without user confirmation.

A vulnerability in Coder allows suspended users to continue using valid API keys until they are deleted. The AI Bridge proxy authentication does not check if the account is suspended, enabling unauthorized access.