-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is an open redirect caused by an unsanitized redirect query parameter. The analysis of the provided commit patch (69c1d981e3131e50d52b01f6a360abadaad699e6) shows changes in two key files:
site/src/pages/LoginPage/LoginPage.tsx: The LoginPage component contained the actual redirection logic. Before the patch, it used the redirectTo parameter (obtained from the URL) directly in navigation components (<Navigate>) or window.location.href assignments. This direct usage of an unsanitized external parameter is the core of the vulnerability. The patch modifies this component to sanitize the redirectTo URL before using it.site/src/pages/LoginPage/LoginPageView.tsx: This file shows that a utility function retrieveRedirect (imported from utils/redirect) was previously used to extract the redirectTo value from the URL's search parameters (location.search). This function is identified as processing the potentially malicious input. The patch refactors how redirectTo is obtained and passed, removing the direct call to retrieveRedirect in this view component.Therefore, LoginPage is identified as the function containing the vulnerable redirection code, and retrieveRedirect is identified as the function that processed the malicious input (the redirect URL).
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/coder/coder/v2 | go | = 2.16.0 | 2.16.1 |
| github.com/coder/coder/v2 | go | >= 2.15.0, < 2.15.3 | 2.15.3 |
| github.com/coder/coder/v2 | go | >= 2.3.1, < 2.14.4 | 2.14.4 |