Octopus Deploy is a popular DevOps automation platform that enables teams to more efficiently manage configuration, API keys, and permissions. Octopus Server allows users to self-host this platform, and is installed as a service on the host. This service runs as Local System and is a very impactful target for local privilege escalation exploits.
This is a writeup for CVE-2021-26556, a local privilege escalation in Octopus Server.
The following versions are affected by this vulnerability:
- All 0.x.x, 1.x.x, 2.x.x, 3.x.x, 4.x.x versions
- All 2018.x.x, 2019.x.x, 2020.1.x, 2020.2.x, 2020.3.x versions
- All 2020.4.x versions before 2020.4.229
- All 2020.5.x versions before 2020.5.256
OctopusDeploy Local Privilege Escalation
In order to investigate field reports of potential permissions issues with the service, we signed up for the free license key here: https://octopus.com/start/server. From there, we were emailed instructions and a license key. Following the installation directions, we install the self-hosted server.
We used the default settings at every step, except for the installation directory which we changed to C:\tools to demonstrate the permission misconfiguration. This directory can either be created through the installer GUI, or through the command line – for example: mkdir C:\tools.
After completing the installation, we found the service was registered as expected.
Note the improper permissions, BUILTIN\Users Allow *, on the installation directory, which are inherited from the drive root:
To fully demonstrate the implications of this vulnerability, we created a new unprivileged user. Then, as this new user, we downloaded the provided CRYPTBASE.dll. Note how the user has permissions to add the poisoned dll to the installation directory. This DLL has a payload which will execute once the file is loaded. For more information on how this file was constructed, see our previous post.
From here, we simply restarted the OctopusDeploy service as an administrator user (restarting the computer would have the same effect). This causes the payload to execute, which creates a file at C:\pwned, containing evidence of what access rights were gained:
If this is not possible, you can also fix the permissions on the existing installation directory, for example, with the script at the bottom of our previous blog post.
|December 31st, 2020||Reported to email@example.com|
|January 3rd, 2021||Octopus Deploy team response|
|January 7th, 2021||Vulnerability triaged by Octopus Deploy team|
|February 20th||Continued correspondence with Octopus Deploy team|
|March 7th||Patch and CVE-2021-26556 released, along with a patch for CVE-2021-26557 which is a similar issue in the Octopus Tentacle service.|
|April 13th, 2021||DeepSurface Advisory published|
We would like to thank the Octopus security team for their excellent response and thoroughness in investigating this issue.