Sensitive values may be exposed in some circumstances via variable preview - CVE-2019-15698

[matt-richardson]

Prerequisites

• We are ready to publicly disclose this vulnerability or exploit according to our responsible disclosure process.
• I have raised a CVE according to our CVE process
• I have written a descriptive issue title
• I have linked the original source of this report
• I have tagged the issue appropriately (area/security, kind/bug, tag/regression?)

Description

In certain circumstances, an authenticated user with VariableView permissions could view sensitive values via the improved variable preview shipped in 2019.7.3. Introduced in #4394.

Affected versions

** Octopus Server** 2019.7.3 - 2019.7.9

Mitigation

Nothing great.

Workarounds

• Upgrade to Octopus 2019.7.10+
• Limit users with VariableView permission
• Ensure all variables that reference a secure variable are themselves marked as sensitive
• Use subscriptions to track modifications to variables to audit access.

Links

Source: internally reported.
Internal issue: https://github.com/OctopusDeploy/OctopusDeploy/issues/4232

[matt-richardson]

Shipped in 2019.7.10

[octoreleasebot]

Release Note: Fixed an issue where in some circumstances, sensitive variables could be exposed in the variable preview

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. If you think you've found a related issue, please contact our support team so we can triage your issue, and make sure it's handled appropriately.