CyberRota Analysis
AI-GeneratedThe vulnerability affects the devcontainer recreate endpoint in specific versions of Coder, allowing low-privilege users to trigger destructive rebuilds of remote development environments without proper authorization checks. This could lead to unintended data loss or disruption of services for organizations using Coder for provisioning via Terraform. Organizations utilizing affected versions should prioritize updating to the fixed releases to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer recreate endpoint relied on route middleware that checked only `ActionRead` on the workspace and, unlike the sibling delete endpoint, performed no `ActionUpdate` check before triggering the destructive rebuild. Exploitation requires an existing low-privilege role with access to the target workspace. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds an explicit `ActionUpdate` authorization check before the agent is dialed like the delete endpoint. No known workarounds are available.
Related CVEs
Other vulnerabilities affecting the same vendor(s)