CVE-2020-27155: 
Octopus Deploy vulnerability analysis and mitigation

A security vulnerability (CVE-2020-27155) was discovered in Octopus Deploy affecting versions 3.11.13 through 2020.4.4. The vulnerability involves the WebSocket polling endpoint, which if enabled, could allow an untrusted tentacle host to present itself as a trusted one. This issue was discovered and disclosed on October 20, 2020. The vulnerability does not affect Octopus Servers running on Linux, as the WebSocket polling endpoint is not available on that platform (Octopus Issues).

The vulnerability exists in the WebSocket polling endpoint configuration of Octopus Deploy. When this endpoint is enabled, it can allow unauthorized connections under certain conditions. The vulnerability received a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating network accessibility, low attack complexity, no privileges required, and high impact on integrity (NVD).

The vulnerability could allow an untrusted tentacle host to masquerade as a trusted one, potentially compromising the integrity of the deployment system. This could lead to unauthorized access and potential manipulation of deployment processes (Octopus Issues).

The vulnerability is exploitable when the WebSocket polling endpoint is enabled, which is not the default configuration. The attack can be executed remotely, requiring no user interaction or special privileges (NVD).

Two mitigation options are available: 1) Upgrade to the latest supported version of Octopus Server that contains the fix, or 2) Disable the WebSocket endpoint using the following commands: .\Octopus.Server.exe service --instance --stop, .\Octopus.Server.exe configure --instance --commsListenWebSocket "", .\Octopus.Server.exe service --instance --start (Octopus Issues).