XSS vulnerability in the All Variables tab

[michaelnoonan]

See https://github.com/OctopusDeploy/OctopusDeploy/issues/1101

CVE-2017-16810

source: https://secure.helpscout.net/conversation/367176482

Steps to recreate:

1. Create a new variable set

2. Put your XSS payload in the name of the variable set, for example: MyVars<img src=x onerror=alert()>

3. Add a variable to your variable set, can be anything you want

4. Add your variable set to an existing or new project

5. View "All Variables" on your project

6. XSS payload fires repeatedly

[michaelnoonan]

Release Note: Fixed a XSS vulnerability with the All Variables Tab (CVE-2017-16810)

[michaelnoonan]

CVE-2017-16810

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. If you think you've found a related issue, please contact our support team so we can triage your issue, and make sure it's handled appropriately.