PT-2026-42031 · Coder · Coder
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Coder versions prior to 2.33.3
Coder versions prior to 2.32.2
Coder versions prior to 2.31.12
Coder versions prior to 2.30.8
Coder versions prior to 2.29.13
Coder versions prior to 2.24.5
Description
An unauthenticated semi-blind Server-Side Request Forgery (SSRF) exists in the
POST /api/v2/workspaceagents/azure-instance-identity endpoint. An attacker can force the server to issue HTTP GET requests to arbitrary internal or external hosts by submitting a crafted PKCS#7 signature. During certificate chain verification, the azureidentity.Validate() function iterates over the IssuingCertificateURL extension and fetches the URL without host restrictions, private-IP blocking, or response-size limits.While the server does not return the target response body, error messages in the API response reveal whether a target is reachable and the type of failure occurred, allowing for internal network reconnaissance and mapping of hosts and ports. Additionally, the server can be directed to hit sensitive endpoints like cloud metadata services. The use of unbounded
io.ReadAll on the response body also creates a memory exhaustion vector.Recommendations
Update to version 2.33.3 or later.
Update to version 2.32.2 or later.
Update to version 2.31.12 or later.
Update to version 2.30.8 or later.
Update to version 2.29.13 or later.
Update to version 2.24.5 or later.
As a temporary workaround, restrict access to the
/api/v2/workspaceagents/azure-instance-identity endpoint using ingress firewall or proxy ACLs if the Azure identity-auth mechanism is not in use.Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Coder