HACKERS gained unauthorized access to Cloudflare-backed infrastructure used by the Coder Registry, hijacking the official registry pool to serve malicious Terraform modules. They added their own IP addresses to the pool at registry.coder[.]com, causing some requests to be routed to the attackers’ servers where a modified copy of the Coder Registry resided. Developers could still reach registry.coder[.]com, but were delivered a compromised Terraform module that included a secret-stealer. The attack ran for about 14 hours on 31 August, from 07:35 to 21:45 UTC, with parts of the traffic landing on the attackers’ infrastructure.
The malicious code operated via a Terraform data “external” block, assisted by scripts named dlp[.]sh and dlp-docker[.]sh, designed to exfiltrate secrets from environment variables, configuration files, and command history. At risk were cloud keys, CI/CD credentials, SSH keys, OIDC tokens, and other credentials accessible to Coder.
If a user ran an infected module within a workspace, the provisioner could obtain the user’s OIDC token, SSH key, and single-use tokens; in some configurations, the attacker could even view a database password. The exfiltrated data was sent to a domain resembling the developer’s infrastructure, coder-infra[.]com, registered on 28 August, three days before the attack. Coder’s advisory notes that there is no precise log trail available from attacker servers, and the incident was rated critical (CVSS 9.0).
Corrected releases are now available (2.37.0, 2.36.4, 2.35.7, 2.34.9), and administrators are advised to inspect DNS, firewalls, proxies, and VPC logs for connections to coder-infra[.]com, search provisioner logs for data.external[.]telemetry, remove suspicious modules from caches, and rotate any secrets the provisioner may have accessed.