cvelistv5 - cve-2025-58437

cve-2025-58437

Vulnerability from cvelistv5

Published

2025-09-06 02:30

Modified

2025-09-08 16:45

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Summary

Coder's privilege escalation vulnerability could lead to a cross workspace compromise

References

▼	URL	Tags
	security-advisories@github.com	https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276
	security-advisories@github.com	https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc0
	security-advisories@github.com	https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a
	security-advisories@github.com	https://github.com/coder/coder/pull/19667
	security-advisories@github.com	https://github.com/coder/coder/pull/19668
	security-advisories@github.com	https://github.com/coder/coder/pull/19669
	security-advisories@github.com	https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp

Impacted products

▼	Vendor	Product
	coder	coder

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-58437",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-08T16:45:07.417468Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-08T16:45:15.915Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "coder",
          "vendor": "coder",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.22.0, \u003c 2.24.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.25.0, \u003c 2.25.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0  and 2.25.1, Coder can be compromised through insecure session handling in prebuilt workspaces. Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via coder_workspace_owner.session_token. Prebuilt workspaces are initially owned by a built-in prebuilds system user. When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the prebuilds user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted. This is fixed in versions 2.24.4 and 2.25.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613: Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-279",
              "description": "CWE-279: Incorrect Execution-Assigned Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-277",
              "description": "CWE-277: Insecure Inherited Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-06T02:30:08.378Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp"
        },
        {
          "name": "https://github.com/coder/coder/pull/19667",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/coder/coder/pull/19667"
        },
        {
          "name": "https://github.com/coder/coder/pull/19668",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/coder/coder/pull/19668"
        },
        {
          "name": "https://github.com/coder/coder/pull/19669",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/coder/coder/pull/19669"
        },
        {
          "name": "https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276"
        },
        {
          "name": "https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc0"
        },
        {
          "name": "https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a"
        }
      ],
      "source": {
        "advisory": "GHSA-j6xf-jwrj-v5qp",
        "discovery": "UNKNOWN"
      },
      "title": "Coder\u0027s privilege escalation vulnerability could lead to a cross workspace compromise"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-58437",
    "datePublished": "2025-09-06T02:30:08.378Z",
    "dateReserved": "2025-09-01T20:03:06.532Z",
    "dateUpdated": "2025-09-08T16:45:15.915Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-58437\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-09-06T03:15:40.287\",\"lastModified\":\"2025-09-08T16:25:38.810\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0  and 2.25.1, Coder can be compromised through insecure session handling in prebuilt workspaces. Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via coder_workspace_owner.session_token. Prebuilt workspaces are initially owned by a built-in prebuilds system user. When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the prebuilds user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted. This is fixed in versions 2.24.4 and 2.25.2.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-277\"},{\"lang\":\"en\",\"value\":\"CWE-279\"},{\"lang\":\"en\",\"value\":\"CWE-613\"}]}],\"references\":[{\"url\":\"https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/coder/coder/pull/19667\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/coder/coder/pull/19668\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/coder/coder/pull/19669\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp\",\"source\":\"security-advisories@github.com\"}]}}"
  }
}

ghsa-j6xf-jwrj-v5qp

Vulnerability from github

Published

2025-09-05 20:19

Modified

2025-09-05 20:19

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Summary

Coder vulnerable to privilege escalation could lead to a cross workspace compromise

Details

Summary

Insecure session handling opened room for a privilege escalation scenario in which prebuilt workspaces could be compromised by abusing a shared system identity.

Details

Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via coder_workspace_owner.session_token. Prebuilt workspaces are initially owned by a built-in prebuilds system user.

When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the prebuilds user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted.

For example, the coder-login module allows template authors to automatically configure the coder CLI to be authenticated with the Coder deployment.

This causes a script to be run on workspace startup that runs the command coder login using the automatically generated user session token c.f. https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/main.tf#L23

This module was originally written before the inception of the prebuilds feature in Coder, which essentially creates a "pre-warmed" pool of workspaces owned by a particular prebuilds system user.

When this module is invoked on a prebuilt workspace, it causes the Coder CLI inside the workspace to persist the session token for the prebuilds user to disk. Because the coder-login module checks if the CLI is authenticated, the script exits early before updating the session token, leaving the Coder CLI authenticated as the prebuildsuser upon claim:

Impact

Important: Deployments that have never utilized the prebuilds feature are not affected by this vulnerability.

This vulnerability requires a previously authenticated user to claim a prebuilt workspace from a template configured to store the prebuilds user session token as described above.

The prebuilds user has no specific roles, so its credential has the same level of access as a regular member user, meaning a user with the prebuilds user's credential can move laterally to any other prebuilt workspace, or create new workspaces as the prebuilds user.

This means that a malicious authenticated actor can potentially execute code on other workspaces owned by the prebuilds user and potentially access information of other users once they claim a previously poisoned workspace.

Remediation

Fixed in https://github.com/coder/coder/pull/19667

Note that prebuilt workspaces claimed previous to the fix may have been affected by this vulnerability. It is recommended that users re-create their workspace if it was created from a prebuild.

To identify potentially affected workspaces, run the following SQL query against the Coder database:

sql SELECT w.id, w.name, w.owner_id, u.email FROM workspaces w LEFT JOIN users u ON u.id = w.owner_id WHERE w.owner_id <> 'c42fdf75-3097-471c-8c33-fb52454d81c0'::uuid AND NOT w.deleted AND EXISTS ( SELECT 1 FROM workspace_builds AS wb WHERE wb.workspace_id = w.id AND wb.initiator_id = 'c42fdf75-3097-471c-8c33-fb52454d81c0'::uuid );

Previous manually created tokens for the prebuilds user are left as-is. You may wish to review these via coder tokens list --all

Premium license customers can also take advantage of the audit logs feature to query actions performed by the prebuilds user.

Following filter can be used to verify if no API keys were created by the prebuilds user

would indicate a potentially malicious action aimed at achieving persistence username:prebuilds resource_type:api_key

Following filter can be used to list all write operations performed by the prebuilds user (including failed attempts to update various settings) username:prebuilds action:write

Patched versions

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/coder/coder/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.22.0"
            },
            {
              "fixed": "2.24.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/coder/coder/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.25.0"
            },
            {
              "fixed": "2.25.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-58437"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-277",
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-05T20:19:58Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nInsecure session handling opened room for a privilege escalation scenario in which [prebuilt workspaces](https://coder.com/docs/admin/templates/extending-templates/prebuilt-workspaces) could be compromised by abusing a shared system identity.\n\n## Details\n\nCoder automatically generates a session token for a user when a workspace is started. It is automatically exposed via [`coder_workspace_owner.session_token`](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/workspace_owner#session_token-1). Prebuilt workspaces are initially owned by a built-in `prebuilds` system user. \n\nWhen a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the `prebuilds` user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted. \n\nFor example, the [coder-login module](https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/run.sh) allows template authors to automatically configure the coder CLI to be authenticated with the Coder deployment.\n\nThis causes a script to be run on workspace startup that runs the command `coder login` using the automatically generated user session token c.f. [https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/main.tf#L23](https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/main.tf#L23)\n\nThis module was originally written before the inception of the [prebuilds](https://coder.com/docs/admin/templates/extending-templates/prebuilt-workspaces) feature in Coder, which essentially creates a \"pre-warmed\" pool of workspaces owned by a particular `prebuilds` system user.\n\nWhen this module is invoked on a prebuilt workspace, it causes the Coder CLI inside the workspace to persist the session token for the `prebuilds` user to disk. Because the `coder-login` module checks if the CLI is authenticated, the script exits early before updating the session token, leaving the Coder CLI authenticated as the `prebuilds`user upon claim:\n\n## Impact\n\n\u003e Important: **Deployments that have never utilized the [prebuilds](https://coder.com/docs/admin/templates/extending-templates/prebuilt-workspaces) feature are not affected by this vulnerability.**\n\n\nThis vulnerability requires a previously authenticated user to claim a prebuilt workspace from a template configured to store the prebuilds user session token as described above.\n\nThe `prebuilds` user has no specific roles, so its credential has the same level of access as a regular member user, meaning a user with the `prebuilds` user\u0027s credential can move laterally to any other prebuilt workspace, or create new workspaces as the `prebuilds` user.\n\nThis means that a malicious authenticated actor can potentially execute code on other workspaces owned by the `prebuilds` user and potentially access information of other users once they claim a previously poisoned workspace.\n\n\n## Remediation\n\nFixed in https://github.com/coder/coder/pull/19667\n\nNote that prebuilt workspaces claimed previous to the fix may have been affected by this vulnerability. It is recommended that users re-create their workspace if it was created from a prebuild.\n\nTo identify potentially affected workspaces, run the following SQL query against the Coder database:\n\n```sql\nSELECT w.id, w.name, w.owner_id, u.email\nFROM workspaces w\nLEFT JOIN users u ON u.id = w.owner_id\nWHERE w.owner_id \u003c\u003e \u0027c42fdf75-3097-471c-8c33-fb52454d81c0\u0027::uuid\n  AND NOT w.deleted\n  AND EXISTS (\n    SELECT 1\n    FROM workspace_builds AS wb\n    WHERE wb.workspace_id = w.id\n      AND wb.initiator_id = \u0027c42fdf75-3097-471c-8c33-fb52454d81c0\u0027::uuid\n  );\n```\n\n\u003e Previous manually created tokens for the prebuilds user are left as-is. You may wish to review these via `coder tokens list --all`\n\n---\n\n[Premium license](https://coder.com/docs/admin/licensing) customers can also take advantage of the [audit logs](https://coder.com/docs/admin/security/audit-logs) feature to query actions performed by the `prebuilds` user.\n\nFollowing [filter](https://coder.com/docs/admin/security/audit-logs#how-to-filter-audit-logs) can be used to verify if no [API keys](https://coder.com/docs/reference/api/users#create-token-api-key) were created by the `prebuilds` user\n\u003e would indicate a potentially malicious action aimed at achieving [persistence](https://attack.mitre.org/tactics/TA0003/)\n```\nusername:prebuilds resource_type:api_key\n```\n\nFollowing [filter](https://coder.com/docs/admin/security/audit-logs#how-to-filter-audit-logs) can be used to list all *write* operations performed by the `prebuilds` user (including failed attempts to update various settings)\n```\nusername:prebuilds action:write\n```\n\n### Patched versions\n- [2.24.4](https://github.com/coder/coder/releases/tag/v2.24.4)\n- [2.25.2](https://github.com/coder/coder/releases/tag/v2.25.2)\n- [2.26.0](https://github.com/coder/coder/releases/tag/v2.26.0)",
  "id": "GHSA-j6xf-jwrj-v5qp",
  "modified": "2025-09-05T20:19:58Z",
  "published": "2025-09-05T20:19:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/coder/coder/pull/19667"
    },
    {
      "type": "WEB",
      "url": "https://github.com/coder/coder/pull/19668"
    },
    {
      "type": "WEB",
      "url": "https://github.com/coder/coder/pull/19669"
    },
    {
      "type": "WEB",
      "url": "https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276"
    },
    {
      "type": "WEB",
      "url": "https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/coder/coder"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Coder vulnerable to privilege escalation could lead to a cross workspace compromise"
}

Action not permitted

cve-2025-58437

Vulnerability from cvelistv5

ghsa-j6xf-jwrj-v5qp

Vulnerability from github

Summary

Details

Impact

Remediation

Patched versions

Tags