CVSS 9.1 · Critical EPSS 0,32%
Kerentanan Improper Verification of Cryptographic Signature pada coder. Skor CVSS 3.1 9.1 (Critical) menurut github.com.
Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, `azureidentity.Validate()` verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself. An attacker can embed a legitimate Azure certificate alongside arbitrary content e.g. `{"vmId":"<target>"}` and the forged `vmId` will be accepted returning the victim workspace agent's session token. No authentication is required. The attacker only needs to know a target VM's `vmId` which is a `UUIDv4`. That's a practical limitation which would typically require prior access to be exploited. Versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 patch the issue. As a workaround, reconfigure any Azure templates to use token authentication rather than `azure-instance-identity`.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| coder | coder | Semua versi sebelum 2.24.5 |
| coder | coder | Versi 2.29.0 hingga sebelum 2.29.13 |
| coder | coder | Versi 2.30.0 hingga sebelum 2.30.8 |
| coder | coder | Versi 2.31.0 hingga sebelum 2.31.12 |
| coder | coder | Versi 2.32.0 hingga sebelum 2.32.2 |
| coder | coder | Versi 2.33.0 hingga sebelum 2.33.3 |