CyberRota Analysis
AI-GeneratedThe vulnerability allows a malicious or compromised Coder server to inject arbitrary SSH configuration into users' `~/.ssh/config` files by exploiting unvalidated server-supplied SSH settings. This could lead to unauthorized access or man-in-the-middle attacks, making it critical for organizations using affected versions prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2 to prioritize updates. Users should also consider inspecting the output of `coder config-ssh --dry-run` as a temporary mitigation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder config-ssh` wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) into the user's `~/.ssh/config` without sanitizing embedded newlines or restricting directives so a malicious or compromised Coder server could inject arbitrary SSH configuration. Practical exploitation requires control of the server-supplied values through a malicious or compromised deployment, a man-in-the-middle position or admin access to the `HostnameSuffix` and `SSHConfigOptions` settings. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates `HostnameSuffix` and `SSHConfigOptions` against a strict character set that rejects newlines and other control characters. As a workaround, inspect `coder config-ssh --dry-run` output before applying changes.
Related CVEs
Other vulnerabilities affecting the same vendor(s)