Octopus Deploy

Description

Octopus Deploy invites you to test and help secure our standalone on premise products: Octopus Server & Octopus Tentacle. We appreciate your efforts and hard work in making Octopus Deploy a more secure product, and look forward to working with the researcher community to create a meaningful and successful bug bounty program. Good luck and happy hunting! Ratings / Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Please see below for any deviations from the standard VRT. Note: This application shares some of the same codebase as the cloud version. It is still highly recommended that you submit your vulnerability, but please note that issues found in this shared codebase would be considered duplicates of each other.

Targets

Testing is only authorised on the targets listed as in scope. Any domain/property of Octopus not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you identify a security vulnerability on a target not in scope but demonstrably belongs to Octopus, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation. Target Information This program only provides monetary rewards for vulnerability research on supported versions of: Octopus Server Octopus Tentacle Currently, supported versions on our website are available to download . They fall out of support 6 months after becoming available. A getting started guide has been provided to assist you with installing Octopus Deploy. Free license Please sign up for an account on octopus.com using your @bugcrowdninja.com email address here . For more info regarding @bugcrowdninja email addresses, see here . Please be aware that octopus.com is not in scope and is not an authorised target of this program. If you are interested in researching octopus.com, please check out our dedicated bounty program for it here . Focus Areas Feel free to explore our product security and give us feedback, but please keep some things in mind: Octopus Server and Tentacle are designed to run privileged, arbitrary code on the environments that they are installed on. We expect code to run under the controlled conditions for which the product is intended. We will only reward research in arbitrary code execution if it results in privileged execution on the server via a novel or unintended execution vector (e.g. command injection through some mechanism that isn’t intended to run script code). We consider bugs that allow users to elevate their privilege within our system to be a priority. Our RBAC is comprehensive, and we want to ensure it is safe for our customers. Messaging between the server and the tentacle is intended to be encrypted, so broken encryption vulnerabilities that lead to a demonstrated, reproducible leak of secret information over the wire are also a priority for us to fix if they occur. We do our best to ensure that secrets are removed from task logs; however, it isn’t always possible, given the nature of arbitrary code execution. We are concerned about scenarios when variables explicitly marked as ‘sensitive’ are not correctly masked in the task logs for a deployment. Out of Scope and Other Exclusions To be as clear as possible, the following are also out of scope for testing : Any of our closed-source tooling, build chain, public-facing repositories, email and IM servers, social media accounts or 3rd party SaaS products that we use to deliver our services. Any internal or development services. Descriptive error messages (e.g. stack traces, application or server errors). HTTP 404 codes/pages or other HTTP non-200 codes/pages. Fingerprinting/banner disclosure on common/public services. Disclosure of known public files or directories (e.g. robots.txt). Clickjacking and issues only exploitable through clickjacking. CSRF on forms that are available to anonymous users (e.g. the contact form). CSRF attacks that require knowledge of the CSRF token (e.g. attacks involving a local machine). Logout Cross-Site Request Forgery. Content spoofing. Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality. Lack of secure/HTTP-only flags on non-sensitive cookies. Lack of security speed bump when leaving the site. Login or forgot password page brute force and account lockout not enforced. SSL/TLS Issues, e.g. SSL Attacks such as BEAST, BREACH, and Renegotiation attacks. SSL Forward secrecy not enabled. SSL weak/insecure cipher suites. Expired certificates or certificates with a long expiration time. Self-XSS reports will not be accepted. Similarly, any XSS requiring local access (i.e., user-agent header injection) will not be accepted. The only exception will be if you can show a working off-path MiTM attack that will trigger the XSS. Vulnerabilities limited to old browsers will not be accepted (i.e. "this exploit only works in IE6/IE7"). Known vulnerabilities in used libraries (e.g. jQuery) - unless you can prove exploitability. Any source code disclosure. Information disclosure of non-confidential information (e.g. issue ID, project ID). Secrets such as API keys or passwords obtained from external aggregation/indexed data sources (e.g. dehashed.com or intelx.io). NPM name squatting is not considered a valid finding unless the package name is referenced as a dependancy by at least one octopus NPM package Testing is only authorised on the targets listed as in-scope. Any domain/property of Octopus not listed in the targets section is out of scope. This includes any/all products not listed above. If you happen to identify a security vulnerability on a target that is not in-scope but that demonstrably belongs to Octopus, it may be reported to this program and is appreciated - but will ultimately be marked as 'not applicable' and will not be eligible for monetary or points-based compensation. Other Rules Reports need to be submitted in plain text (associated pictures/videos are fine as long as they're in standard formats and are accompanied by a plain text report). Non-plain text reports (e.g. PDF, DOCX) will be asked to be resubmitted in plain text. Grants/awards are at the discretion of Octopus Deploy, and we withhold the right to grant, modify or deny grants. Please, no social engineering, phishing or unauthorised access to infrastructure. Please don’t test the physical security of Octopus Deploy offices, employees, equipment, etc. This bounty follows Bugcrowd’s standard disclosure terms. Public Disclosure Before publicly disclosing an issue, we require you to request our permission. Octopus Deploy will process requests for public disclosure on a per-report basis. Requests to publicly disclose an issue that has not yet been fixed for customers will be rejected. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.