CVE-2025-58437

{
  "id": "CVE-2025-58437",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-06T03:15:40.287",
  "lastModified": "2026-10-19T17:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0  and 2.25.1, Coder can be compromised through insecure session handling in prebuilt workspaces. Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via coder_workspace_owner.session_token. Prebuilt workspaces are initially owned by a built-in prebuilds system user. When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the prebuilds user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted. This is fixed in versions 2.24.4 and 2.25.2."
    },
    {
      "lang": "es",
      "value": "Coder permite a las organizaciones aprovisionar entornos de desarrollo remotos a través de Terraform. En las versiones 2.22.0 a 2.24.3, 2.25.0 y 2.25.1, Coder puede verse comprometido debido a un manejo inseguro de la sesión en espacios de trabajo preconstruidos. Coder genera automáticamente un token de sesión para un usuario cuando se inicia un espacio de trabajo. Se expone automáticamente a través de coder_workspace_owner.session_token. Los espacios de trabajo preconstruidos son inicialmente propiedad de un usuario del sistema de preconstrucciones integrado. Cuando se reclama un espacio de trabajo preconstruido, se genera un nuevo token de sesión para el usuario que reclamó el espacio de trabajo, pero el token de sesión anterior para el usuario de preconstrucciones no caducó. Cualquier plantilla de espacio de trabajo de Coder que persista este token de sesión generado automáticamente puede verse potencialmente afectada. Esto se solucionó en las versiones 2.24.4 y 2.25.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "coder",
          "product": "coder",
          "versions": [
            {
              "version": ">= 2.22.0, < 2.24.4",
              "status": "affected"
            },
            {
              "version": ">= 2.25.0, < 2.25.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-08T16:45:07.417468Z",
          "id": "CVE-2025-58437",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-277"
        },
        {
          "lang": "en",
          "value": "CWE-279"
        },
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ]
    },
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:*",
              "versionStartIncluding": "2.22",
              "versionEndExcluding": "2.24.4",
              "matchCriteriaId": "A8F90474-94D7-4818-9484-420FB0730C13"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:*",
              "versionStartIncluding": "2.25.0",
              "versionEndExcluding": "2.25.2",
              "matchCriteriaId": "99234FDA-3823-4D78-BE28-7A9F54A58481"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc0",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/coder/coder/pull/19667",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking"
      ]
    },
    {
      "url": "https://github.com/coder/coder/pull/19668",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking"
      ]
    },
    {
      "url": "https://github.com/coder/coder/pull/19669",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking"
      ]
    },
    {
      "url": "https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}