Summary

An issue on Coder's login page allows attackers to craft a Coder URL that when clicked by a logged in user could redirect them to a website the attacker controls, e.g.https://google.com.

Details

On the login page, Coder checks for the presence of aredirect query parameter. On successful login, the user would be redirected to the location of the parameter. Improper sanitization allows attackers to specify a URL outside of the Coder application to redirect users to.

Impact

Coder users could potentially be redirected to a untrusted website if tricked into clicking a URL crafted by the attacker. Coder authentication tokens arenot leaked to the resulting website.

To check if your deployment is vulnerable, visit the following URL for your Coder deployment:

• https://<coder url>/login?redirect=https%3A%2F%2Fcoder.com%2Fdocs

Patched Versions

This vulnerability is remedied in

• v2.16.1
• v2.15.3
• v2.14.4

All versions prior to 2.3.1 are not affected.

Thanks

• https://github.com/jchristov

References

GHSA-wcx9-ccpj-hx3c
69c1d98