Memory Corruption in Coder Remote Dev Environments

Executive Summary

This vulnerability exists in Coder versions starting from 2.17.0 up to versions before 2.29.7, 2.32.7, 2.33.8, and 2.34.2. It occurs in the `POST /api/v2/files` endpoint, which converts uploaded zip files to tar format in memory. While there is a size limit on each individual entry in the archive, there is no limit on the total decompressed size of all entries combined. This allows an attacker with authenticated file-upload access to cause the system to write to an unbounded in-memory buffer, potentially exhausting system resources.

The vulnerability can be exploited to cause a denial of service by overwhelming the system's memory during decompression.

The issue was fixed in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 by adding a metadata preflight check that sums the projected sizes of all entries and by using a streaming writer that enforces an aggregate size limit during decompression.

As a workaround, it is recommended to restrict file-upload permissions to trusted users or to place a reverse proxy with request-body size limits in front of the affected service.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is on availability. An attacker with authenticated file-upload access can exploit the lack of an aggregate decompression size limit to cause a denial of service by consuming excessive memory resources.

There is no impact on confidentiality or integrity, as the vulnerability does not allow unauthorized data access or modification.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, restrict file-upload permissions to trusted users only.

Alternatively, place a reverse proxy with request-body size limits in front of the coderd service to limit the size of uploads.

Also, upgrade to fixed versions 2.29.7, 2.32.7, 2.33.8, or 2.34.2 where the vulnerability is addressed by adding aggregate size limits during decompression.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability impacts availability by allowing a denial of service through unbounded memory consumption during file decompression. However, there is no indication that it affects confidentiality or integrity of data.

Since the vulnerability does not involve unauthorized data access or data leakage, it is unlikely to directly impact compliance with data protection regulations such as GDPR or HIPAA, which primarily focus on protecting personal data confidentiality and integrity.

Organizations should still address the vulnerability to maintain system availability, which is a component of overall security best practices and may indirectly support compliance efforts.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability requires authenticated file-upload access to the endpoint POST /api/v2/files in Coder versions starting from 2.17.0 up to but not including 2.29.7, 2.32.7, 2.33.8, and 2.34.2. Detection involves verifying the version of Coder in use and monitoring or restricting access to this API endpoint.

Since exploitation involves uploading zip files that are converted to tar archives without aggregate size limits, one detection approach is to monitor or log file upload requests to /api/v2/files for unusually large or suspicious payloads.

No specific commands or detection scripts are provided in the available information.

As a workaround, restrict file-upload permissions to trusted users or place a reverse proxy with request-body size limits in front of the coderd service to mitigate potential exploitation.

Useful 0 Not Useful 0