Improper Hostname Validation in Coder Workspace Proxy

Coder versions prior to 2.29.20, 2.33.12, 2.34.8, and 2.35.4 contain a critical vulnerability in the GetWorkspaceProxyByHostname function. The application uses a SIMILAR TO pattern that performs an insecure prefix match for hostname validation. This flaw allows an attacker to register or control a malicious domain that is a string prefix of a legitimate workspace-proxy access URL. By luring an authenticated victim into clicking a specially crafted link pointing to /api/v2/applications/auth-redirect, an attacker can capture sensitive application_connect API keys. These captured keys can then be replayed to gain unauthorized access to the victim's workspace applications, potentially resulting in full workspace compromise and lateral movement within the development environment.

Impact

Successful exploitation allows for the theft of workspace-specific API keys. An attacker with these credentials can impersonate the victim, gain unauthorized access to workspace applications, and potentially exfiltrate sensitive source code, development environment secrets, or interact with cloud resources configured within the workspace.

Recommendation

1. Upgrade all Coder installations to the patched versions: 2.29.20, 2.33.12, 2.34.8, or 2.35.4 or later.
2. Implement strict domain allowlisting for workspace-proxy access URLs to mitigate potential prefix collision attacks.
3. Audit existing Coder API keys for unauthorized usage patterns if the environment was exposed during the period preceding the patch.