Octopus Deploy Server-Side Request Forgery Vulnerability Allowing Account Compromise

A server-side request forgery (SSRF) vulnerability has been identified in Octopus Deploy running on Microsoft Windows. This vulnerability allows an attacker to manipulate the server into sending requests that include authentication information. As a result, the attacker could compromise the account associated with Octopus Server and potentially affect the underlying host infrastructure.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the account running Octopus Server, with possible repercussions for the host infrastructure.

Remediation

Users are advised to upgrade Octopus Server to version 2024.4.7065 or 2024.3.13071. The latest version can be downloaded from the Octopus Deploy website, while previous versions are available from the Octopus Deploy previous versions page.