CyberRota Analysis
AI-GeneratedThe vulnerability affects the Java-based Coder application, specifically in its workspace app proxy, which improperly prioritizes the `X-Forwarded-Host` header over the legitimate `Host` header, potentially allowing attackers to manipulate routing. This could lead to unauthorized access or redirection if subdomain app routing is enabled and the victim interacts with a maliciously crafted app. Organizations using affected versions should prioritize patching to versions 2.29.7, 2.32.7, 2.33.8, or 2.34.2, or implement an upstream reverse proxy to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app proxy resolves the target app from `httpapi.RequestHost()` which prefers the `X-Forwarded-Host` header over the real `Host` header. No middleware strips `X-Forwarded-Host` before routing and the header is not browser-forbidden so client-side JavaScript can set it on `fetch()` calls. Practical exploitation requires subdomain app routing (wildcard hostname) enabled, a victim who visits the attacker's shared app and a deployment whose upstream proxy does not strip `X-Forwarded-Host`. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 trusts `X-Forwarded-Host` only from configured trusted proxies and otherwise resolves the routing host from the verified request host. As a workaround, place an upstream reverse proxy that strips or overwrites `X-Forwarded-Host` on untrusted requests.
Related CVEs
Other vulnerabilities affecting the same vendor(s)