CVE-2020-26161: 
Octopus Deploy vulnerability analysis and mitigation

CVE-2020-26161 is a security vulnerability affecting Octopus Deploy versions from 2019.8.2 through 2020.4.2. The vulnerability was discovered and disclosed in October 2020, allowing attackers to potentially redirect users to external sites through manipulation of HTTP Host headers (GitHub Issues).

The vulnerability exists in the HTTP to HTTPS redirection middleware of Octopus Deploy, which accepts user-provided Host headers to generate redirection URLs. This implementation flaw becomes particularly dangerous when Octopus is deployed behind a caching reverse-proxy, as it could be exploited for request hijacking (GitHub Issues).

When exploited, this vulnerability could allow attackers to redirect users to external malicious sites, potentially leading to phishing attacks or other malicious activities when Octopus Deploy is configured behind a caching reverse-proxy (GitHub Issues).

The vulnerability requires the attacker to be able to manipulate HTTP Host headers in requests to an Octopus Deploy instance that is specifically configured behind a caching reverse-proxy (GitHub Issues).

The vulnerability was addressed in Octopus Deploy version 2020.4.3. Users are advised to upgrade to this version or later to protect against this security issue (GitHub Issues).