CVE-2019-1003027: SSRF vulnerability due to missing permission check in Jenkins OctopusDeploy Plugin

The vulnerability stems from a form validation method in OctopusDeployPlugin.java that handled URL connectivity checks. Jenkins security advisory GHSA-5v2j-w677-j4mp explicitly states this was a form validation method missing two critical security controls:

1. No permission check beyond Overall/Read
2. Accepted GET requests (CSRF vector)

Jenkins plugin conventions indicate form validation methods follow the 'doCheck[ParameterName]' naming pattern. The URL parameter being validated (likely 'octopusUrl') would make 'doCheckOctopusUrl' the vulnerable method. This matches the advisory's description of the attack vector allowing SSRF through URL connectivity tests. The function would appear in runtime profiling when attackers trigger the vulnerable endpoint to perform SSRF.