CVE-2024-58398 coder CVE debrief

Who should care

Defenders responsible for Coder deployments, especially in environments where phishing attacks are a concern, should assess the vulnerability and verify exposure. This includes operators, platform administrators, vulnerability management teams, and security teams who need to prioritize verifying exposure and assessing the vulnerability in their Coder deployments.

Why it matters

CVE-2024-58398 is a medium-severity open redirect vulnerability in Coder that allows phishing attacks through crafted login URLs. Defenders should prioritize verifying exposure and assessing the vulnerability in their Coder deployments.

• Phishing attacks may be facilitated through crafted login URLs
• Defenders should verify exposure and assess vulnerability in Coder deployments
• Remediation priority is moderate due to the medium severity of the vulnerability

Technical summary

The vulnerability is caused by improper sanitization of the redirect query parameter in the Coder login page. This allows an attacker to craft a Coder login URL that redirects a logged-in user to an attacker-controlled website for phishing. The vulnerability affects Coder versions 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1. Defenders should prioritize verifying exposure and assessing the vulnerability in their Coder deployments, especially in environments where phishing attacks are a concern.

Defensive priority

Defenders should prioritize verifying exposure and assessing the vulnerability in their Coder deployments, especially in environments where phishing attacks are a concern.

Recommended defensive actions

• Verify Coder deployment versions and check for exposure
• Assess the vulnerability in environments where phishing attacks are a concern
• Consider upgrading to a fixed version of Coder
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in Coder versions 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1. However, the exact scope of affected deployments and potential exploitation remains unknown.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.