Authentication Bypass in Coder via Azure Certificate Spoofing

Executive Summary

This vulnerability exists in Coder's remote development environment provisioning via Terraform in certain versions before 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3. The function azureidentity.Validate() checks that the PKCS#7 signer certificate chains to a trusted Azure CA but fails to verify the PKCS#7 signature itself.

An attacker can exploit this by embedding a legitimate Azure certificate alongside arbitrary content, such as a forged vmId, which is accepted by the system. This allows the attacker to obtain the victim workspace agent's session token without any authentication.

The attacker only needs to know the target VM's vmId, which is a UUIDv4, making exploitation practically limited to those with prior access or knowledge.

The issue is patched in versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3. A workaround is to reconfigure Azure templates to use token authentication instead of azure-instance-identity.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to a victim's workspace agent session token, allowing an attacker to impersonate the victim's session.

Since no authentication is required to exploit this, an attacker who knows a target VM's vmId can gain access, potentially leading to unauthorized actions within the development environment.

The impact includes compromise of confidentiality and integrity of the affected system, as indicated by the CVSS score of 9.1 with high confidentiality and integrity impact.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update Coder to one of the patched versions: 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, or 2.33.3.

As a workaround, reconfigure any Azure templates to use token authentication instead of azure-instance-identity.

Useful 0 Not Useful 0