Authentication Bypass in Coder via Azure Certificate Spoofing

Executive Summary

This vulnerability exists in Coder's remote development environment provisioning via Terraform in certain versions before 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3. The function azureidentity.Validate() checks that the PKCS#7 signer certificate chains to a trusted Azure CA but fails to verify the PKCS#7 signature itself.

An attacker can exploit this by embedding a legitimate Azure certificate alongside arbitrary content, such as a forged vmId, which is accepted by the system. This allows the attacker to obtain the victim workspace agent's session token without any authentication.

The attacker only needs to know the target VM's vmId, which is a UUIDv4, making exploitation practically limited to those with prior access or knowledge.

The issue is patched in versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3. A workaround is to reconfigure Azure templates to use token authentication instead of azure-instance-identity.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to a victim's workspace agent session token, allowing an attacker to impersonate the victim's session.

Since no authentication is required to exploit this, an attacker who knows a target VM's vmId can gain access, potentially leading to unauthorized actions within the development environment.

The impact includes compromise of confidentiality and integrity of the affected system, as indicated by the CVSS score of 9.1 with high confidentiality and integrity impact.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update Coder to one of the patched versions: 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, or 2.33.3.

As a workaround, reconfigure any Azure templates to use token authentication instead of azure-instance-identity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to steal sensitive data such as agent session tokens, Git SSH keys, OAuth tokens, and workspace secrets by bypassing PKCS#7 signature verification. Such unauthorized access to sensitive information can lead to violations of data protection and privacy regulations like GDPR and HIPAA, which require strict controls over the confidentiality and integrity of personal and sensitive data.

Because the vulnerability enables attackers to access sensitive credentials and secrets without authentication, organizations using affected versions of Coder may fail to meet compliance requirements related to access control, data confidentiality, and secure authentication mechanisms.

Mitigations such as applying patches or switching to token authentication are necessary to restore compliance and reduce the risk of data breaches that could result in regulatory penalties.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the improper verification of PKCS#7 signatures in Azure instance identity tokens within the Coder platform. Detection would involve identifying usage of vulnerable Coder versions prior to 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3.

To detect if your system is vulnerable, you should first check the installed version of Coder to see if it falls within the affected versions.

• Run a command to check the Coder version, for example: `coder --version` or check the version in your deployment manifests or Terraform configurations.

Since the vulnerability involves forged PKCS#7 tokens with arbitrary content such as a forged vmId, network detection could involve monitoring for unusual or unauthorized Azure instance identity token usage or suspicious API calls that include unexpected vmId values.

No specific detection commands or signatures are provided in the available resources, but monitoring logs for unexpected session token issuance or anomalous vmId values could help identify exploitation attempts.

As a workaround, reconfigure Azure templates to use token authentication instead of azure-instance-identity to mitigate risk until patched.

Useful 0 Not Useful 0