Coder CVE-2023-58437 Privilege Escalation via Prebuilds Session Token

Critical Vulnerability Information Vulnerability Overview Title: Privilege escalation abusing a shared system identity could lead to a cross workspace compromise Publisher: jdomeracki-coder Release Time: 2 days ago CVE ID: CVE-2023-58437 CVSS v3 Base Metrics: - Severity: High (8.1/10) - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged 着机密性影响: High - Integrity Impact: High - Availability Impact: None Affected Scope Affected Versions: >=2.22, <2.24.4, <2.25.2, <2.26.0 Fixed Versions: 2.24.4, 2.25.2, 2.26.0 Vulnerability Description Summary: Insecure session handling opens the door to privilege escalation scenarios, where prebuilt workspaces may be compromised by abusing a shared system identity. Details: Coder automatically generates a session token for users when launching a workspace, exposing it via . Prebuilt workspaces are initially owned by the built-in system user. When a prebuilt workspace is claimed, a new session token is generated for the claiming user, but the previous session token for the user is not expired, creating a potential security risk. Impact Important Note: Deployments that have never used the feature are not affected by this vulnerability. Attack Scenario: An authenticated user can claim a prebuilt workspace and exploit the user’s session token to perform lateral movement or create new workspaces, enabling execution of malicious code and access to other users’ information. Mitigation Fix Commit: #19667 Recommendation: Use the following SQL query to identify potentially affected workspaces: Enterprise License Holders: Can use the audit logs feature to query actions performed by the user.

Goal Reached Thanks to every supporter — we hit 100%!

Coder CVE-2023-58437 Privilege Escalation via Prebuilds Session Token

More from this source