WebSocket polling endpoint can allow untrusted connections

[adam-mccoy]

Prerequisites

• We are ready to publicly disclose this vulnerability or exploit according to our responsible disclosure process.
• I have raised a CVE according to our CVE process
• I have written a descriptive issue title
• I have linked the original source of this report
• I have tagged the issue appropriately (area/security, kind/bug, tag/regression?)

Description

If configured, the WebSocket polling endpoint can allow untrusted connections to be made under certain conditions. This endpoint is not enabled by default.

This issue does not affect Octopus Servers running on Linux, as the WebSocket polling endpoint is not available.

Affected versions

Octopus Server: 3.11.13 to 2020.4.5

Mitigation

Upgrade to the latest available supported version of Octopus Server.

Workarounds

Disable WebSocket endpoint

Use the following commands to disable the WebSocket endpoint.

.\Octopus.Server.exe service --instance <INSTANCE NAME> --stop
.\Octopus.Server.exe configure --instance <INSTANCE NAME> --commsListenWebSocket ""
.\Octopus.Server.exe service --instance <INSTANCE NAME> --start

Links

CVE: CVE-2020-27155
Internal Issue: https://github.com/OctopusDeploy/OctopusDeploy/issues/7424
PR: https://github.com/OctopusDeploy/OctopusDeploy/pull/7435

[octoreleasebot]

Release Note: Fix bug where bash script can reveal sensitive variable values - CVE: CVE-2020-25825