Self-hosted Octopus susceptible to host-header injection attacks

[johnsimons]

Are you a customer of Octopus Deploy? Don't raise the issue here. Please contact our security team so we can triage your report, making sure it's handled appropriately.

Prerequisites

• We are ready to publicly disclose this vulnerability or exploit according to our responsible disclosure process.
• I have raised a CVE according to our CVE process
• I have written a descriptive issue title
• I have linked the original source of this report
• I have tagged the issue appropriately (area/security, kind/bug, tag/regression?)

Description

The HTTP to HTTPS redirection middleware will accept the given Host header to generate the redirection URL. This can be exploited to hijack requests when Octopus is behind a caching reverse-proxy.

Affected versions

Octopus Server: 2019.8.2 to Current

Links

CVE: CVE-2020-26161
Internal Issue: https://github.com/OctopusDeploy/OctopusDeploy/issues/7351
PR: https://github.com/OctopusDeploy/OctopusDeploy/pull/7353

[johnsimons]

Release Note: Fix bug where Self-hosted Octopus susceptible to host-header injection attacks (CVE-2020-26161)

[maulda]

Hello, is the CVE-2020-25825 used twice ? Because it is already mentioned and assigned in #6604.

[johnsimons]

@pencil-vester, good catch, fixed link. Cheers