Coder 2.30.x < 2.32.7 / 2.33.x < 2.33.8 / 2.34.x < 2.34.2 AI Bridge Proxy TLS Verification Bypass

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(326278);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/13");

  script_cve_id("CVE-2026-55436");
  script_xref(name:"IAVB", value:"2026-B-0188");

  script_name(english:"Coder 2.30.x < 2.32.7 / 2.33.x < 2.33.8 / 2.34.x < 2.34.2 AI Bridge Proxy TLS Verification Bypass");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Coder installed on the remote host is 2.30.x prior to 2.32.7, 2.33.x prior to 2.33.8, or
2.34.x prior to 2.34.2. It is, therefore, affected by a vulnerability.

The AI Bridge Proxy skips TLS certificate verification in the default configuration. The proxy created a goproxy
server whose default transport set InsecureSkipVerify and only assigned a secure transport when an upstream proxy was
configured. In the default configuration (no upstream proxy), outbound HTTPS to the Coder access URL accepted any TLS
certificate, enabling potential interception of session tokens and API keys by an on-path attacker.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/coder/coder/security/advisories/GHSA-84rm-42xw-mx52");
  script_set_attribute(attribute:"solution", value:
"Update Coder to version 2.32.7, 2.33.8, or 2.34.2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-55436");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:coder:coder");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("coder_win_installed.nbin");
  script_require_keys("installed_sw/Coder");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Coder', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '2.30.0', 'fixed_version': '2.32.7'},
        {'min_version': '2.33.0', 'fixed_version': '2.33.8'},
        {'min_version': '2.34.0', 'fixed_version': '2.34.2'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);