GHSA-8fxq-53rx-ph5f
Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison
빠른 조치
GHSA-8fxq-53rx-ph5f — github.com/coder/coder/v2: 아래 명령으로 수정 버전으로 올리세요.
go get github.com/coder/coder/v2@v2.34.2상세
### Summary
`userpassword.Compare()` substituted a placeholder hash derived from the well-known string `"hunter2"` when the stored hash was empty. Submitting `"hunter2"` therefore matched accounts with no password hash (nonexistent users and SSO-only users) and a subsequent login-type check returned an HTTP 403 that disclosed the account's login type, versus 401 for password users.
> **Note:** Practical exploitation is limited because the timing side channel is noisy and only reveals whether an account exists.
### Impact
An unauthenticated attacker could enumerate valid accounts and their authentication provider by submitting logins with the password `"hunter2"`, distinguishing nonexistent users, SSO users (provider revealed) and password users from the response. This aids credential-stuffing and targeted phishing. No authentication bypass or data access resulted.
### Patches
The fix derives the timing-defense placeholder from a secure random value that no supplied password can match.
The fix was backported to all supported release lines:
| Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) |
### Workarounds
None.
### References
- Fix: #26205
### Credits
We'd like to thank Anthropic's Security Team (ANT-2026-22433) for independently disclosing this issue!
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
2.34.0 수정 버전: 2.34.2 go get github.com/coder/coder/v2@v2.34.2 2.33.0 수정 버전: 2.33.8 go get github.com/coder/coder/v2@v2.33.8 2.30.0 수정 버전: 2.32.7 go get github.com/coder/coder/v2@v2.32.7 0 수정 버전: 2.29.17 go get github.com/coder/coder/v2@v2.29.17 참고
- https://github.com/coder/coder/security/advisories/GHSA-8fxq-53rx-ph5f [WEB]
- https://github.com/coder/coder/pull/26205 [WEB]
- https://github.com/coder/coder/commit/35a7dc8ab9c7f15ce05d963947823ee31224512f [WEB]
- https://github.com/coder/coder [PACKAGE]
- https://github.com/coder/coder/releases/tag/v2.29.17 [WEB]
- https://github.com/coder/coder/releases/tag/v2.32.7 [WEB]
- https://github.com/coder/coder/releases/tag/v2.33.8 [WEB]
- https://github.com/coder/coder/releases/tag/v2.34.2 [WEB]