PT-2025-36355 · Coder · Coder

Johnstcn · Published 2025-09-05 · Updated 2025-10-17 · CVE-2025-58437

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Coder versions 2.22.0 through 2.24.3 Coder versions 2.25.0 and 2.25.1

Description Coder allows organizations to provision remote development environments via Terraform. In affected versions, Coder can be compromised through insecure session handling in prebuilt workspaces. Coder automatically generates a session token for a user when a workspace is started, exposed via coder workspace owner.session token. When a prebuilt workspace is claimed, a new session token is generated for the user, but the previous session token for the prebuilds system user is not expired. Workspace templates that persist this automatically generated session token are potentially impacted. This could lead to a privilege escalation and cross-workspace compromise.

Recommendations Update to Coder version 2.24.4 or 2.25.2.

Exploit

Fix

LPE

Insufficient Session Expiration

Improper Privilege Management

Weakness Enumeration

CWE-279

CWE-277

CWE-613

CWE-269

Related Identifiers

CVE-2025-58437

GHSA-J6XF-JWRJ-V5QP

GO-2025-3938

OPENSUSE-SU-2025:15564-1

SUSE-SU-2025:03289-1

Affected Products

Coder

References · 56

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58437.json · Exploit
• https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc0 · Patch
• https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276 · Patch
• https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a · Patch
• https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3938 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58437 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58437 · Security Note
• https://osv.dev/vulnerability/GHSA-j6xf-jwrj-v5qp · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15564-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03289-1 · Vendor Advisory
• https://github.com/coder/coder · Note
• https://github.com/coder/coder/pull/19669 · Note
• https://github.com/coder/coder/pull/19667 · Note
• https://github.com/coder/coder/pull/19668 · Note