CVE-2022-41245 in Execution Manager Plugin
Summary
by MITRE • 09/21/2022
A cross-site request forgery (CSRF) vulnerability in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/28/2025
The CVE-2022-41245 vulnerability represents a critical cross-site request forgery flaw within the Jenkins Worksoft Execution Manager Plugin version 10.0.3.503 and earlier. This vulnerability falls under the CWE-352 category, which specifically addresses cross-site request forgery conditions that enable attackers to perform unauthorized actions on behalf of authenticated users. The flaw exists in the plugin's handling of authentication credentials and API interactions, creating a pathway for malicious actors to exploit the system's trust mechanisms.
The technical implementation of this CSRF vulnerability allows attackers to construct malicious requests that leverage existing user sessions to interact with the Jenkins instance. When an authenticated user visits a malicious page or clicks on a crafted link, the vulnerability enables the attacker to make requests to the Jenkins API using credentials stored within the system. This particular weakness stems from insufficient validation of the origin of requests and lack of proper anti-CSRF token implementation within the plugin's web interface. The vulnerability is particularly dangerous because it operates at the authentication layer, allowing attackers to access credential storage mechanisms that are typically protected from direct access.
The operational impact of this vulnerability extends beyond simple credential theft, as it provides attackers with the capability to execute arbitrary actions within the Jenkins environment. Attackers can use compromised credentials to access build servers, modify job configurations, execute malicious code, or even escalate privileges within the Jenkins infrastructure. This vulnerability directly affects the principle of least privilege and can lead to complete system compromise if attackers gain access to administrative credentials. The attack vector typically involves social engineering techniques where users are tricked into visiting malicious websites that contain embedded CSRF payloads targeting their Jenkins sessions.
Mitigation strategies for CVE-2022-41245 should focus on immediate plugin updates to versions that address the CSRF implementation flaws and proper configuration of anti-CSRF protections. Organizations should implement network-level controls to restrict access to Jenkins instances and ensure that only authorized networks can reach these systems. The use of Jenkins' built-in CSRF protection mechanisms, proper session management, and regular security auditing of plugins should be enforced. Additionally, credential rotation procedures should be implemented immediately upon discovery of the vulnerability, and security teams should monitor for suspicious API activity that might indicate exploitation attempts. This vulnerability aligns with ATT&CK technique T1566, which covers social engineering tactics, and T1528, which addresses credential access through application access. Organizations should also consider implementing principle of least privilege access controls and regular security assessments to prevent similar vulnerabilities from being exploited in other components of their CI/CD pipelines.