CVE-2025-59956: Coder AgentAPI exposed user chat history via a DNS rebinding attack

The vulnerability, identified as GHSA-w64r-2g3w-w8w4, is a DNS rebinding attack in Coder AgentAPI prior to version 0.4.0. The root cause was improper validation of Host and Origin headers for the HTTP server running on localhost. An attacker could craft a malicious webpage that, when visited by a user running the agent, would use DNS rebinding to bypass the browser's same-origin policy. This would allow the malicious site to send requests to the agent's API, specifically targeting the /messages endpoint to exfiltrate sensitive chat history.

The analysis of the patch commit 5c425c62447b8a9eac19e9fc5a2eae7f0803f149 reveals the core of the vulnerability and its fix. The function httpapi.NewServer was identified as the primary vulnerable function because it was responsible for setting up the server with an insecure CORS policy (AllowedOrigins: "*"), effectively trusting requests from any origin. The patch rectifies this by introducing strict Host and Origin header validation.

A new middleware, httpapi.hostAuthorizationMiddleware, was added to enforce Host header validation. This function is called for every incoming request in the patched version. While not present in the vulnerable versions, its addition is the key to the remediation and highlights that the vulnerability lay in the absence of such a check. During an exploit against a vulnerable version, any of the API endpoint handlers, such as getMessages (for the /messages endpoint), would be present in the runtime profile. However, the fundamental flaw is in the server's initial setup (NewServer), which fails to apply the necessary security controls to protect these endpoints.