Coder CVE-2024-45796 Unauthenticated Semi-blind SSRF via Azure Instance Identity Endpoint

Vulnerability Overview Vulnerability Name: Unauthenticated semi-blind SSRF via Azure Instance Identity Endpoint Vulnerability Description: An unauthenticated semi-blind Server-Side Request Forgery (SSRF) exists via the Azure Instance Identity Endpoint ( ). External attackers can force the Coder server to send HTTP GET requests to arbitrary internal or external hosts by submitting forged PKCS#7 signatures. Although the server does not return the target response body, error messages in the API response reveal whether the target is reachable and the type of failure. Impact Scope Internal Network Reconnaissance: Attackers can scan the internal network by observing error messages in the API responses (e.g., "connection refused", "timeout") to determine if ports are open. Requests to Sensitive Endpoints: The server can be induced to access cloud metadata services (e.g., ), internal management interfaces, etc. Error Information Leakage: Wrapped Go HTTP client errors in the field expose internal hostnames, IP addresses, port numbers, and network topology details. Denial of Service (Memory Exhaustion): Unrestricted allows attackers to point the to large resources, forcing the server to buffer the entire response in memory. Fix Solutions Fixed Versions: 2.33.3 2.32.2 2.31.12 2.30.8 2.29.13 2.24.5 Temporary Mitigations: If Azure authentication mechanisms are not in use, the vulnerability can be mitigated by restricting access to the corresponding endpoint ( ), such as using firewalls and/or proxy ACLs. POC Code Exploit Code: Additional Information CVSS v3 Base Metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: None - User interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: Low - Availability: None CVE ID: CVE-2024-45796 Credits: bencalf Acknowledgments: Thanks to Ben Tran of Califo and the Security Team at Anthropic (ANT-2626-22447) for independently disclosing this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Coder CVE-2024-45796 Unauthenticated Semi-blind SSRF via Azure Instance Identity Endpoint

More from this source