PT-2024-22135 · Coder · Coder

Arcz · Published 2024-03-04 · Updated 2025-12-04 · CVE-2024-27918

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions Coder versions prior to 2.6.1 Coder versions prior to 2.7.3 Coder versions prior to 2.8.4

Description A vulnerability in Coder's OIDC authentication could allow an attacker to bypass the CODER OIDC EMAIL DOMAIN verification and create an account with an email not in the allowlist. Deployments are only affected if the OIDC provider allows users to create accounts on the provider. During OIDC registration, the user's email was improperly validated against the allowed CODER OIDC EMAIL DOMAINs. This could allow a user with a domain that only partially matched an allowed domain to successfully login or register. An attacker could register a domain name that exploited this vulnerability and register on a Coder instance with a public OIDC provider. Coder instances with OIDC enabled and protected by the CODER OIDC EMAIL DOMAIN configuration are affected. Public OIDC providers are impacted, while GitHub authentication and external authentication are not impacted.

Recommendations For versions prior to 2.6.1, upgrade to version 2.6.1 or later. For versions prior to 2.7.3, upgrade to version 2.7.3 or later. For versions prior to 2.8.4, upgrade to version 2.8.4 or later. As a temporary workaround, consider restricting access to the OIDC authentication feature until a patch is available. Restrict access to the CODER OIDC EMAIL DOMAIN configuration to minimize the risk of exploitation. Avoid using public OIDC providers without proper configuration and validation of the CODER OIDC EMAIL DOMAIN setting.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-27918

GHSA-7CC2-R658-7XPF

GO-2024-2602

Affected Products

Coder

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27918.json · Exploit
• https://github.com/coder/coder/commit/2d37eb42e7db656e343fe1f36de5ab1a1a62f4fb · Patch
• https://github.com/coder/coder/commit/1171ce7add017481d28441575024209ac160ecb0 · Patch
• https://github.com/coder/coder/commit/2ba84911f8b02605e5958d5e4a2fe3979ec50b31 · Patch
• https://github.com/coder/coder/commit/4439a920e454a82565e445e4376c669e3b89591c · Patch
• https://github.com/coder/coder/security/advisories/GHSA-7cc2-r658-7xpf · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7cc2-r658-7xpf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27918 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27918 · Security Note
• https://osv.dev/vulnerability/GO-2024-2602 · Vendor Advisory
• https://github.com/coder/coder · Note
• https://t.me/cveNotify/144788 · Telegram Post
• https://twitter.com/cracbot/status/1771321509849477475 · Twitter Post