CVE-2025-13472

Executive Summary

CVE-2025-13472 is an information disclosure vulnerability in the BlazeMeter Jenkins Plugin, versions prior to 4.27. The flaw allows any authenticated Jenkins user, regardless of their assigned permissions, to view sensitive resource identifiers such as credential IDs, BlazeMeter workspace names, and project IDs. This information is exposed via a dropdown menu in the Jenkins UI. The vulnerability was addressed in version 4.27 by enforcing proper permission checks before displaying these resources.

Supply Chain & Package Security

This vulnerability is specific to the BlazeMeter Jenkins Plugin, which is a component within the Jenkins CI/CD ecosystem. It does not directly affect NPM, PyPI, Go, or Ruby packages. However, organizations using Jenkins as part of their software supply chain should treat this as a critical configuration and access control issue, as exposed credential IDs could be leveraged in broader supply chain attacks.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Estimated 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated Jenkins user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of resource IDs)
• Integrity Impact: None
• Availability Impact: None
• Threat Level: Medium (information disclosure that could aid further attacks)

Deep Dive & Mechanics

The vulnerability exists in the BlazeMeter Jenkins Plugin's UI components that generate dropdown lists for selecting credential IDs, workspaces, and project IDs. Prior to version 4.27, the plugin did not verify whether the authenticated user had the necessary permissions (e.g., Credentials/View or Job/Configure) before populating these dropdowns. This allowed any user with access to the Jenkins UI to enumerate sensitive identifiers.

The fix in version 4.27 introduces permission checks using Jenkins' built-in ACL (Access Control List) framework. The plugin now calls Jenkins.get().getACL().hasPermission() or similar methods to ensure the user has the required permissions before querying and displaying the resource list.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-4.27):

// No permission check before populating dropdown
public ListBoxModel doFillCredentialsIdItems() {
    ListBoxModel model = new ListBoxModel();
    for (Credentials c : CredentialsProvider.lookupCredentials(...)) {
        model.add(c.getId(), c.getId());
    }
    return model;
}

Patched Code (4.27+):

public ListBoxModel doFillCredentialsIdItems() {
    // Check permission first
    Jenkins.get().checkPermission(CredentialsProvider.VIEW);
    ListBoxModel model = new ListBoxModel();
    for (Credentials c : CredentialsProvider.lookupCredentials(...)) {
        model.add(c.getId(), c.getId());
    }
    return model;
}

Exploitation & Lab Setup

Red Team

1. Prerequisites: Access to a Jenkins instance with the BlazeMeter Plugin (< 4.27) installed. Any authenticated user account (e.g., read-only user).
2. Steps:
   • Log in to Jenkins with the low-privilege account.
   • Navigate to any job configuration page that uses the BlazeMeter plugin.
   • Inspect the HTML source or use browser developer tools to view the dropdown options for credential IDs, workspaces, or project IDs.
   • Alternatively, send a direct HTTP request to the doFillCredentialsIdItems endpoint (e.g., /job/MyJob/descriptorByName/com.blazemeter.jenkins.plugin.BlazeMeterBuilder/fillCredentialsIdItems).
3. Impact: Obtain a list of credential IDs, workspace names, and project IDs that can be used in subsequent attacks (e.g., credential reuse, targeted phishing).

Blue Team

1. Detection: Monitor Jenkins access logs for unusual requests to doFill* endpoints from low-privilege users.
2. Hunting: Search for users who accessed job configuration pages without having Job/Configure or Credentials/View permissions.
3. Response: Immediately upgrade to BlazeMeter Plugin version 4.27 or later. If upgrade is not possible, restrict access to Jenkins UI using network segmentation or reverse proxy authentication.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /descriptorByName/com.blazemeter.jenkins.plugin.BlazeMeterBuilder/fillCredentialsIdItems from unexpected users.
• Logs: Jenkins access logs showing GET /job/*/descriptorByName/com.blazemeter.jenkins.plugin.BlazeMeterBuilder/* from users without Credentials/View permission.
• File: No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2025_13472_BlazeMeter_InfoDisclosure {
    meta:
        description = "Detects vulnerable BlazeMeter Jenkins Plugin versions"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-13472"
    strings:
        $vuln_class = "doFillCredentialsIdItems" nocase
        $vuln_method = "ListBoxModel" nocase
    condition:
        $vuln_class and $vuln_method
}

Sigma Rule

title: BlazeMeter Plugin Information Disclosure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized access to BlazeMeter resource dropdowns
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: jenkins
detection:
    selection:
        cs-uri-query|contains: "/descriptorByName/com.blazemeter.jenkins.plugin.BlazeMeterBuilder/fill"
    condition: selection
falsepositives:
    - Legitimate administrators performing configuration
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13472 BlazeMeter Plugin Information Disclosure Attempt"; flow:to_server; content:"/descriptorByName/com.blazemeter.jenkins.plugin.BlazeMeterBuilder/fill"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade the BlazeMeter Jenkins Plugin to version 4.27 or later.
2. Workaround: If upgrade is not possible, restrict access to Jenkins UI using network-level controls (e.g., VPN, IP whitelisting) and enforce strong authentication.
3. Long-term: Implement the principle of least privilege for all Jenkins users. Regularly audit plugin permissions and update to latest versions.
4. Monitoring: Enable detailed audit logging in Jenkins and monitor for unauthorized access to configuration pages.

Valters IT