Open Redirect Vulnerability in Coder Login Page

Executive Summary

CVE-2024-58398 is an open redirect vulnerability in Coder versions 2.3.1 to 2.14.3, 2.15.0 to 2.15.2, and 2.16.0. The login page's redirect query parameter is not properly sanitized, allowing attackers to craft URLs that redirect logged-in users to attacker-controlled websites for phishing attacks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Coder deployment version is between 2.3.1-2.14.3, 2.15.0-2.15.2, or 2.16.0. Visit the specific URL on your deployment to verify vulnerability presence as suggested in the advisory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could trick users into visiting malicious websites through phishing links. While authentication tokens are not exposed, attackers may steal credentials or install malware. Users might unknowingly disclose sensitive information or grant unauthorized access to systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily enables phishing attacks through open redirects, which could lead to unauthorized access to sensitive data. While not directly violating GDPR or HIPAA, such attacks may result in data breaches that trigger compliance obligations under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Coder to versions 2.14.4, 2.15.3, or 2.16.1 or later to patch the open redirect vulnerability. Ensure proper URL sanitization is implemented in login redirect functionality.

Useful 0 Not Useful 0