Description
Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
coder coder
Default version status: unaffected
2.35.0 to < 2.35.4affected2.35.4unaffected
pkg:golang/github.com/coder/coder/v2coder coder
Default version status: unaffected
2.34.0 to < 2.34.8affected2.34.8unaffected
pkg:golang/github.com/coder/coder/v2coder coder
Default version status: unaffected
2.33.0 to < 2.33.12affected2.33.12unaffected
pkg:golang/github.com/coder/coder/v2coder coder
Default version status: unaffected
0 to < 2.29.20affected2.29.20unaffected
pkg:golang/github.com/coder/coder/v2