Privilege Escalation in Coder Remote Development Environments

Executive Summary

This vulnerability exists in the Coder platform's devcontainer recreate endpoint, which previously only checked for read permissions (ActionRead) on a workspace before allowing a devcontainer to be rebuilt. Unlike the delete endpoint, it did not require update permissions (ActionUpdate), which are necessary because recreating a devcontainer is a destructive action that modifies the workspace state.

As a result, users with low-privilege roles that have read-only access could trigger a destructive rebuild of devcontainers, potentially causing data loss or disruption.

The issue was fixed by adding an explicit ActionUpdate authorization check before the devcontainer recreate operation is allowed, aligning it with the delete endpoint's permission requirements.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to destructive rebuilds of development containers by users who only have read access, which can cause loss of uncommitted in-container data.

Repeated triggering of this action could result in denial of service by disrupting development environments.

Because the vulnerability allows low-privilege users to perform destructive actions, it undermines the intended access control and can impact the stability and integrity of development workflows.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Coder platform to one of the fixed versions: 2.29.7, 2.32.7, 2.33.8, or 2.34.2. These versions include a patch that adds an explicit ActionUpdate authorization check before allowing the devcontainer recreate operation, preventing users with only read permissions from triggering destructive rebuilds.

No known workarounds are available, so applying the patch by upgrading is the immediate and recommended step.

Useful 0 Not Useful 0