Coder v2.29.17 Security Advisory: Fixes RCE, XSS, Privilege Escalation, and DoS Vulnerabilities

Vulnerability Overview Coder v2.29.17 has been released, primarily to address multiple security vulnerabilities. These vulnerabilities were discovered through a coordinated vulnerability disclosure program in collaboration with Anthropic's Project Glasswing. Impact Scope Trusted proxy configuration relying on : Could lead to information disclosure or privilege escalation. OIDC email fallback to the first linked account: Could result in incorrect account linkage. OIDC login when the claim is non-boolean or missing: Could allow authentication bypass. Validation of and : Could lead to configuration errors. Server: Validation of workspace owner matching application username: Could lead to privilege escalation. Rejection of oversized and invalid zip uploads: Could lead to denial-of-service (DoS) attacks. HTML escaping of proxy logs: Could lead to Cross-Site Scripting (XSS). Proxy: Prevention of command injection in shell executors: Could lead to Remote Code Execution (RCE). Server: Prevention of user administrators resetting owner passwords: Could lead to privilege escalation. Validation of in to prevent OOM DoS: Could lead to denial-of-service attacks. Validation of provided in the coordinator: Could lead to network attacks. Server: Prevention of cross-tenant workspace application rebinding: Could lead to data leakage. CLI: Prevention of session token leakage via external application URLs: Could lead to session hijacking. Clamping of template port sharing levels in : Could lead to port conflicts. Server: Use of random values for simulated hash of built-in users: Could lead to hash collisions. Server: Requirement of update permissions to recreate : Could lead to privilege escalation. Dashboard: Escaping display values in HTML output: Could lead to Cross-Site Scripting (XSS). Remediation Update to version v2.29.17: This is the latest version that fixes all the aforementioned vulnerabilities. Follow the recommendations in the Security Patches section: Specific patches include: - Only trust from configured trusted proxies. - Restrict OIDC email fallback to the first linked account. - Validate the claim during OIDC login. - Validate and . - Validate that the workspace owner matches the application username. - Reject oversized and invalid zip uploads. - Escape HTML in proxy logs. - Prevent command injection in shell executors. - Prevent user administrators from resetting owner passwords. - Validate in to prevent OOM DoS. - Validate provided in the coordinator. - Prevent cross-tenant workspace application rebinding. - Prevent session token leakage via external application URLs. - Clamp template port sharing levels in . - Use random values for the simulated hash of built-in users. - Require update permissions to recreate . - Escape display values in HTML output. Installation/Upgrade Refer to documentation for installation or upgrade: You can use the provided installation or upgrade guides. Use release assets: The latest release assets can be downloaded from the GitHub release page. Container Image Pull the latest container image: Use the following command to pull the latest container image: Contributors Thanks to contributors: Thanks to geokat, zedkipp, and dylanhuff-at-coder for their contributions. Assets Download release assets: Related release assets can be downloaded from the release page. The above summary covers the key vulnerability information from the page, including the vulnerability overview, impact scope, and remediation plans.

Goal Reached Thanks to every supporter — we hit 100%!

Coder v2.29.17 Security Advisory: Fixes RCE, XSS, Privilege Escalation, and DoS Vulnerabilities

More from this source