Privilege Escalation in Coder Remote Development Environments

Executive Summary

This vulnerability exists in Coder's remote development environment provisioning via Terraform. Before certain fixed versions, the API endpoint for changing user passwords allowed a user with the privileged 'user-admin' role to reset the password of an 'owner' account without requiring the current password. This means that a user-admin could change the owner account's password without proper authorization checks.

The issue arises because the endpoint only authorized 'ActionUpdatePersonal' and did not prevent user-admins from resetting owner passwords. The vulnerability requires the attacker to have the user-admin role, so the risk is limited to deployments where this role is granted to less trusted operators.

The fix implemented in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 prevents non-owner users from resetting the password of an owner account. As a workaround, it is recommended to restrict the user-admin role to trusted administrators.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows a user with the user-admin role to reset the password of an owner account without knowing the current password. This could lead to unauthorized access to the owner account, potentially compromising the entire system or environment managed by Coder.

Since the owner account typically has the highest level of privileges, an attacker could gain full control, leading to confidentiality, integrity, and availability impacts as indicated by the CVSS score (7.2) with high impact on confidentiality, integrity, and availability.

The practical risk depends on how the user-admin role is assigned; if it is granted to less trusted operators, the risk is higher.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, restrict the 'user-admin' role to trusted administrators only.

Additionally, upgrade Coder to one of the fixed versions: 2.29.7, 2.32.7, 2.33.8, or 2.34.2, which prevent non-owner users from resetting the password of an account holding the 'owner' role.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a user with the privileged user-admin role to reset the password of an owner account without requiring the current password. This could lead to unauthorized access to sensitive data or administrative functions.

Such unauthorized access risks violating compliance requirements in standards and regulations like GDPR and HIPAA, which mandate strict controls over access to sensitive personal and health information.

However, the practical risk is limited to deployments that grant the user-admin role to less trusted operators, and the issue is mitigated by restricting this role to trusted administrators or by applying the fixed versions.

Useful 0 Not Useful 0