Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

coder/code-server

              main @ 9ccf763
            

Fixes

CVEs

CRITICAL

Peak severity

48.6%

Coverage

Highlights

Auth Bypass: 13 prior fixes. Scrutinize any change in this area.

src/node/http.ts: most-fixed (7 issues). Treat as high-risk during review.

21 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Critical routing path endpoints failed to block unauthorized requests due to asynchronous authentication checks (authenticated) being left unawaited, resulting in silent authorization bypasses. Related WebSocket routes in pathProxy.ts also completely lacked authentication checks.

Cross-Site WebSocket Hijacking: A missing origin validation check on the HTTP/WebSocket upgrade handshake exposed the server to cross-site socket manipulation, allowing malicious external sites to connect to the internal IDE instance. This risk is tracked via CVE-2023-26114.

Server-Side Request Forgery: Insecure parsing of the proxy destination port parameter permitted attackers to manipulate the getProxyTarget resolution, resulting in server-side request forwarding or host injection to arbitrary network locations.