Nathan Willoughby

In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login identities could result in that user being granted elevated permissions, up to and including system administrator access. This issue affects instances using LDAP authentication with self-service login editing enabled.

يؤدي عدم كفاية حماية سلامة ملفات تعريف ارتباط المصادقة، إلى جانب التحقق غير الصحيح من الأذونات الممنوحة للمستخدم الذي يسمح له بعرض المستخدمين أو أحداث التدقيق، إلى إمكانية قيام المستخدم بتصعيد صلاحياته إلى صلاحيات المسؤول.

In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project triggers could result in the user being able to run runbooks or create deployments they were not authorised to perform.

In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search.

In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.

In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires a service account with at least one OIDC identity configured. An attacker would also need to know or guess some details of that identity in order to be in a position to attempt exploitation.

In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the unclaimed invitation could allow the user to escalate privileges however this is dependant on the permissions assigned for the invited user.

Users with certain scoped permission sets can execute arbitrary scripts in an environment without the necessary authorization.

An authenticated user with permissions to edit an Environment or Project can provide specifically crafted JSON content for the object. This leads to insecure deserialization, which allows the user to execute arbitrary code within the Octopus Server process. Insecure deserialization occurs when untrusted data is used to abuse the logic of an application to execute unintended code.