Certificate private keys downloadable when guest user has admin rights

[michaelnoonan]

Issue

See private issue: https://github.com/OctopusDeploy/OctopusDeploy/issues/1282

CVE-2017-15610

When the special Guest user account is granted the CertificateExportPrivateKey permission, and Guest Access is enabled for the Octopus Server, an attacker can sign in as the Guest account and export Certificates managed by Octopus, including the private key.

We generally recommend the Guest account is not granted these high-level permissions, but want to take the extra step to ensure private keys are never leaked to the Guest user account.

Affected Versions

Octopus 3.11.0 to 3.17.6. Fixed in Octopus 3.17.7.

Implemented Solution

The special Guest account is specifically denied access to export certificates including the private key, even if the Guest account has been granted the CertificateExportPrivateKey permission.

Fixed in https://github.com/OctopusDeploy/OctopusDeploy/pull/1384

[michaelnoonan]

Release Notes: The special Guest account is now denied access to certificate private keys, even if that user has been granted the CertificateExportPrivateKey permission

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. If you think you've found a related issue, please contact our support team so we can triage your issue, and make sure it's handled appropriately.