VMware has issued an urgent advisory to uninstall the deprecated Enhanced Authentication Plugin (EAP) due to a critical security flaw identified as CVE-2024-22245 (CVSS score: 9.6). The vulnerability is an arbitrary authentication relay bug that could compromise Active Directory.
Vulnerability Details:
- CVE ID: CVE-2024-22245
- CVSS Score: 9.6 (Critical)
- Affected Software: VMware Enhanced Authentication Plugin (EAP)
- Impact: Arbitrary authentication relay, compromising Active Directory
Description:
The vulnerability allows a malicious actor to trick a target domain user with EAP installed in their web browser into requesting and relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs). EAP, deprecated as of March 2021, is designed for direct login to vSphere’s management interfaces and tools through a web browser. A related session hijack flaw (CVE-2024-22250, CVSS score: 7.8) was also discovered, allowing a malicious actor with unprivileged local access to a Windows operating system to seize a privileged EAP session.
Mitigation Strategies:
- Uninstall EAP: VMware recommends uninstalling the Enhanced Authentication Plugin altogether to mitigate potential threats. Use the client operating system’s method of uninstalling software to remove EAP from client systems.
- Monitor for Suspicious Activity: Keep an eye on Active Directory logs for any unusual activity that may indicate exploitation attempts.
- Regular Updates: Ensure that all VMware and other software are up to date with the latest security patches and updates.
Recommendations:
IT and security teams should take immediate action to uninstall the Enhanced Authentication Plugin from affected systems. Given the critical nature of the vulnerability and its potential impact on Active Directory, swift remediation is essential to maintain the security of the network and sensitive data.
Stay safe and informed,
OP Innovate Research Team.
