CVE-2023-28674
📋 TL;DR
This CSRF vulnerability in Jenkins OctoPerf Load Testing Plugin allows attackers to trick authenticated users into connecting to attacker-controlled Octoperf servers using attacker-specified credentials. It affects Jenkins instances with the OctoPerf plugin installed, potentially exposing sensitive testing data and credentials.
💻 Affected Systems
- Jenkins OctoPerf Load Testing Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could redirect load testing data to malicious servers, steal credentials, manipulate test results, or use the Jenkins instance as a pivot point to attack internal Octoperf infrastructure.
Likely Case
Attackers could capture sensitive load testing data, credentials, or use the connection to perform further attacks against the Octoperf infrastructure.
If Mitigated
With proper CSRF protections and network segmentation, impact is limited to potential data exposure from the specific Jenkins instance.
🎯 Exploit Status
Exploitation requires tricking an authenticated user into visiting a malicious page while logged into Jenkins.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.5.3
Vendor Advisory: https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-3067%20(4)
Restart Required: Yes
Instructions:
1. Update Jenkins OctoPerf Load Testing Plugin to version 4.5.3 or later via Jenkins Plugin Manager. 2. Restart Jenkins service. 3. Verify plugin version in Jenkins plugin list.
🔧 Temporary Workarounds
Enable CSRF Protection
allEnsure Jenkins global security has CSRF protection enabled (default in recent versions)
Check Jenkins > Manage Jenkins > Configure Global Security > Enable CSRF Protection
Network Segmentation
allRestrict Jenkins access to trusted networks only
Configure firewall rules to limit Jenkins access to internal IP ranges
🧯 If You Can't Patch
- Remove or disable the OctoPerf plugin if not needed
- Implement strict access controls and monitor for suspicious Octoperf connection attempts
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin list for OctoPerf Load Testing Plugin version 4.5.2 or earlierCheck Version:
Navigate to Jenkins > Manage Jenkins > Manage Plugins > Installed tab, search for 'OctoPerf'Verify Fix Applied:
Verify OctoPerf plugin version is 4.5.3 or later in Jenkins plugin list📡 Detection & Monitoring
Log Indicators:
- Unexpected Octoperf server connection attempts
- CSRF token validation failures in Jenkins logs
Network Indicators:
- Outbound connections from Jenkins to unknown Octoperf servers
SIEM Query:
source="jenkins.log" AND ("Octoperf" OR "CSRF") AND ("failed" OR "unauthorized")