GHSA-j6xf-jwrj-v5qp: Coder vulnerable to privilege escalation could lead to a cross workspace compromise
SummaryInsecure session handling opened room for a privilege escalation scenario in which [prebuilt workspaces](https://coder.com/docs/admin/templates/extending-templates/prebuilt-workspaces) could be compromised by abusing a shared system identity.DetailsCoder automatically generates a session token for a user when a workspace is started. It is automatically exposed via [`coder_workspace_owner.session_token`](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/workspace_owner#session_token-1). Prebuilt workspaces are initially owned by a built-in `prebuilds` system user.When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the `prebuilds` user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted.For example, the [coder-login module](https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/run.sh) allows template authors to automatically configure the coder CLI to be authenticated with the Coder deployment.This causes a script to be run on workspace startup that runs the command `coder login` using the automatically generated user session token c.f. [https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/main.tf#L23](https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/main.tf#L23)This module was originally written before the inception of the [prebuilds](https://coder.com/docs/admin/templates/extending-templates/prebuilt-workspaces) feature in Coder, which essentially creates a "pre-warmed" pool of workspaces owned by a particular `prebuilds` system user.When this module is invoked on a prebuilt workspace, it causes the Coder CLI inside the workspace to persist the session token for the `prebuilds` user to disk. Because the `coder-login` module checks if the CLI is authenticated, the script exits early before updating the session token, leaving the Coder CLI authenticated as the `prebuilds`user upon claim:ImpactImportant: **Deployments that have never utilized the [prebuilds](https://coder.com/docs/admin/templates/extending-templates/prebuilt-workspaces) feature are not affected by this vulnerability.**This vulnerability requires a previously authenticated user to claim a prebuilt workspace from a template configured to store the prebuilds user session token as described above.The `prebuilds` user has no specific roles, so its credential has the same level of access as a regular member user, meaning a user with the `prebuilds` user's credential can move laterally to any other prebuilt workspace, or create new workspaces as the `prebuilds` user.This means that a malicious authenticated actor can potentially execute code on other workspaces owned by the `prebuilds` user and potentially access information of other users once they claim a previously poisoned workspace.RemediationFixed in https://github.com/coder/coder/pull/19667Note that prebuilt workspaces claimed previous to the fix may have been affected by this vulnerability. It is recommended that users re-create their workspace if it was created from a prebuild.To identify potentially affected workspaces, run the following SQL query against the Coder database:Previous manually created tokens for the prebuilds user are left as-is. You may wish to review these via `coder tokens list --all`[Premium license](https://coder.com/docs/admin/licensing) customers can also take advantage of the [audit logs](https://coder.com/docs/admin/security/audit-logs) feature to query actions performed by the `prebuilds` user.Following [filter](https://coder.com/docs/admin/security/audit-logs#how-to-filter-audit-logs) can be used to verify if no [API keys](https://coder.com/docs/reference/api/users#create-token-api-key) were created by the `prebuilds` userwould indicate a potentially malicious action aimed at achieving [persistence](https://attack.mitre.org/tactics/TA0003/)Following [filter](https://coder.com/docs/admin/security/audit-logs#how-to-filter-audit-logs) can be used to list all *write* operations performed by the `prebuilds` user (including failed attempts to update various settings)Patched versions[2.24.4](https://github.com/coder/coder/releases/tag/v2.24.4)[2.25.2](https://github.com/coder/coder/releases/tag/v2.25.2)[2.26.0](https://github.com/coder/coder/releases/tag/v2.26.0)
CVSS v3.1: 8.1