Attack Chain

1. An authenticated user gains control over and modifies a Coder workspace agent within their own workspace.
2. The attacker, knowing the victim agent's UUID, deterministically calculates the victim agent's tailnet IP address.
3. The attacker's modified agent returns an HTTP redirect (e.g., 307 or 308) in response to a control-plane client's API request.
4. The crafted redirect's Location header specifies the derived tailnet IP of the victim agent.
5. Due to insecure default redirect handling, the control-plane client follows the redirect, sending its subsequent workspace agent API request to the victim agent's IP instead of the intended (attacker's) agent.
6. The victim agent, processing the request as if it originated legitimately from the control plane, performs the requested action (e.g., file read or write).
7. If the workspace agent process API is exposed, the attacker writes a malicious payload via the redirected file API.
8. The attacker then redirects a process-start request to execute the payload, achieving remote command execution as the victim workspace user and crossing workspace/tenant boundaries.

Impact

Successful exploitation allows an authenticated user to gain unauthorized access to files and potentially achieve remote code execution (RCE) on other workspace agents within the Coder environment. This means an attacker can read sensitive files, modify critical data, or execute arbitrary commands as the victim workspace user, effectively compromising other users' workspaces and potentially breaching tenant boundaries. The consequence could range from data exfiltration and sabotage to complete compromise of sensitive development environments, leading to intellectual property theft or further network penetration. The vulnerability requires an authenticated user with control over a modified agent but the impact extends beyond their initial scope.

Recommendation

• Upgrade all Coder installations immediately to a patched version: v2.34.4, v2.33.10, v2.32.9, or v2.29.19 (ESR) or later, as specified in the provided patches section.
• Ensure that Coder instances are updated to address GHSA-qrwj-vh9x-gw5v to disable automatic redirect following for workspace agent API clients.
• Confirm that all workspace agent API dials pin to the intended agent's deterministic tailnet address and reject requests whose URL host does not match the intended agent, as described in the fix.