CVE-2024-3825: Insufficient Information (NVD-CWE-noinfo)
value: Versions of the BlazeMeter Jenkins plugin prior to 4.22 contain a flaw which results in credential enumeration

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-17T15:15Z
Repository: https://github.com/Blazemeter/blazemeter-jenkins-plugin
Language: XML
Files changed: CHANGELOG.md, pom.xml, src/main/java/hudson/plugins/blazemeter/BlazeMeterPerformanceBuilderDescriptor.java
Commit date: 2024-04-17 14:26:12 +0530
Commit message: Fix for TT4016

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 385e667..25d8062 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
+### v4.22 - 16-04-2024
+
+- `FIXED` - Fixed TT-4016
+
 ### v4.21 - 14-02-2024
 
 - `FIXED` - Fixed TT-3873 Tests are not getting fetched in the Jenkins BlazeMeter plugin
 
 ### v4.20 - 18-09-2023
diff --git a/pom.xml b/pom.xml
index d039b89..fa70d78 100644
--- a/pom.xml
+++ b/pom.xml
@@ -13,11 +13,11 @@
     </properties>
 
     <groupId>com.blazemeter.plugins</groupId>
     <artifactId>BlazeMeterJenkinsPlugin</artifactId>
     <packaging>hpi</packaging>
-    <version>4.21-SNAPSHOT</version>
+    <version>4.22-SNAPSHOT</version>
     <name>BlazeMeter plugin</name>
     <url>https://wiki.jenkins-ci.org/display/JENKINS/BlazeMeter+Plugin</url>
     <description>This is a plugin which allows a developer to run a set of performance tests against the BlazeMeter Cluster</description>
     <inceptionYear>July 2012</inceptionYear>
 
@@ -36,11 +36,11 @@
 
     <scm>
         <connection>scm:git:git@github.com:jenkinsci/blazemeter-plugin.git</connection>
         <developerConnection>scm:git:git@github.com:jenkinsci/blazemeter-plugin.git</developerConnection>
         <url>https://github.com/jenkinsci/blazemeter-plugin</url>
-        <tag> BlazeMeterJenkinsPlugin-4.20</tag>
+        <tag> BlazeMeterJenkinsPlugin-4.21</tag>
     </scm>
 
     <licenses>
         <license>
             <name>LGPL 3</name>
@@ -91,10 +91,15 @@
         <dependency>
             <groupId>javax.validation</groupId>
             <artifactId>validation-api</artifactId>
             <version>1.0.0.GA</version>
         </dependency>
+        <dependency>
+            <groupId>org.kohsuke.stapler</groupId>
+            <artifactId>stapler</artifactId>
+            <version>1.263</version>
+        </dependency>
 
     </dependencies>
 
     <distributionManagement>
         <repository>
diff --git a/src/main/java/hudson/plugins/blazemeter/BlazeMeterPerformanceBuilderDescriptor.java b/src/main/java/hudson/plugins/blazemeter/BlazeMeterPerformanceBuilderDescriptor.java
index e0506bd..12ee53a 100644
--- a/src/main/java/hudson/plugins/blazemeter/BlazeMeterPerformanceBuilderDescriptor.java
+++ b/src/main/java/hudson/plugins/blazemeter/BlazeMeterPerformanceBuilderDescriptor.java
@@ -52,10 +52,11 @@ import net.sf.json.JSONObject;
 import org.apache.commons.lang.StringUtils;
 import org.jenkinsci.Symbol;
 import org.kohsuke.stapler.QueryParameter;
 import org.kohsuke.stapler.Stapler;
 import org.kohsuke.stapler.StaplerRequest;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 @Symbol({"blazeMeterTest"})
 @Extension
 public class BlazeMeterPerformanceBuilderDescriptor extends BuildStepDescriptor<Builder> {
     private static final java.util.logging.Logger LOGGER = java.util.logging.Logger.getLogger(BlazeMeterPerformanceBuilderDescriptor.class.getName());
@@ -129,10 +130,11 @@ public class BlazeMeterPerformanceBuilderDescriptor extends BuildStepDescriptor<
         } else {
             return FormValidation.warning("Unknown script type. Please, select 'Test type' in BlazeMeter web application");
         }
     }
 
+    @RequirePOST
     public ListBoxModel doFillTestIdItems(@QueryParameter("credentialsId") String credentialsId,
                                           @QueryParameter("workspaceId") String workspaceId,
                                           @QueryParameter("testId") String testId) throws FormValidation {
 
         ListBoxModel items = new ListBoxModel();
@@ -235,10 +237,11 @@ public class BlazeMeterPerformanceBuilderDescriptor extends BuildStepDescriptor<
         }
 
         return workspaces;
     }
 
+    @RequirePOST
     public ListBoxModel doFillWorkspaceIdItems(@QueryParameter("credentialsId") String credentialsId,
                                                @QueryParameter("workspaceId") String workspaceId) throws FormValidation {
         ListBoxModel items = new ListBoxModel();
 
         try {
@@ -288,11 +291,11 @@ public class BlazeMeterPerformanceBuilderDescriptor extends BuildStepDescriptor<
 
         workspacesList.add(0, new ListBoxModel.Option(SELECT_WORKSPACE, savedWorkspace, true));
         return workspacesList;
     }
 
-
+    @RequirePOST
     public ListBoxModel doFillCredentialsIdItems(@QueryParameter("credentialsId") String credentialsId) {
         ListBoxModel items = new ListBoxModel();
         try {
 
             Item item = Stapler.getCurrentRequest().findAncestorObject(Item.class);

Vulnerable code:     <version>4.21-SNAPSHOT</version>
        <tag> BlazeMeterJenkinsPlugin-4.20</tag>

Fixed code: ### v4.22 - 16-04-2024

- `FIXED` - Fixed TT-4016

    <version>4.22-SNAPSHOT</version>
        <tag> BlazeMeterJenkinsPlugin-4.21</tag>
        <dependency>
            <groupId>org.kohsuke.stapler</groupId>
            <artifactId>stapler</artifactId>
            <version>1.263</version>
        </dependency>
import org.kohsuke.stapler.interceptor.RequirePOST;
    @RequirePOST
    @RequirePOST
    @RequirePOST