Open Redirect in Coder Workspace App

Executive Summary

Coder versions from 2.0.0 before 2.34.8 have an open redirect vulnerability in the handleAPIKeySmuggling function. Attackers exploit unsanitized URL path values to craft links on trusted workspace app subdomains. These links use paths starting with double slashes, causing scheme-relative redirects to attacker-controlled sites, enabling phishing attacks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unsanitized URL paths in Coder instances before version 2.34.8. Check web server logs for requests with double slashes in paths (e.g., //attacker.com) on trusted subdomains. Inspect HTTP responses for redirects to external domains.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to trick users into visiting malicious sites via seemingly trusted links. Users may unknowingly enter credentials or sensitive data on fake pages, leading to account compromise or data theft. Organizations using affected Coder versions risk phishing attacks targeting employees or customers.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability enables phishing attacks by redirecting users from trusted Coder subdomains to attacker-controlled sites. Such attacks could lead to unauthorized data access or disclosure, violating GDPR's data protection principles and HIPAA's safeguards for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Coder to version 2.34.8 or later immediately. Review and sanitize all URL paths in the handleAPIKeySmuggling function. Implement strict input validation for r.URL.Path values to prevent scheme-relative redirects.

Useful 0 Not Useful 0