VMSA-2024-0003

VMware Enhanced Authentication Plug-in (EAP)

Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) were responsibly reported to VMware. Guidance is available on removing this deprecated component from impacted environments.

The VMware Enhanced Authentication Plug-in (EAP) contains an Arbitrary Authentication Relay vulnerability. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.6.

A malicious actor could trick a target domain user with EAP installed in their web browser into requesting and relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs).

To address CVE-2024-22245 remove the EAP plugin by following the guidance in KB96442.

None.

A supplemental FAQ was created for clarification. Please see: https://via.vmw.com/vmsa-2024-0003-qna

Deprecation of the EAP was announced in 2021 with the release of vCenter Server 7.0u2.

VMware would like to thank Ceri Coburn from Pen Test Partners for reporting this issue to us.

The VMware Enhanced Authentication Plug-in (EAP) contains a Session Hijack vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.8.

A malicious actor with unprivileged local access to a windows operating system can hijack a privileged EAP session when initiated by a privileged domain user on the same system.

To address CVE-2024-22250 remove the EAP plugin by following the guidance in KB96442.

None.

A supplemental FAQ was created for clarification. Please see: https://via.vmw.com/vmsa-2024-0003-qna

Deprecation of the EAP was announced in 2021 with the release of vCenter Server 7.0u2.

VMware would like to thank Ceri Coburn from Pen Test Partners for reporting this issue to us.

Fixed Version(s) and Release Notes:

https://kb.vmware.com/s/article/96442

Mitre CVE Dictionary Links:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22245

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22250

FIRST CVSSv3 Calculator:

CVE-2024-22245: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVE-2024-22250: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

2024-02-20 VMSA-2024-0003
Initial security advisory.

E-mail: security@vmware.com

PGP key at:
https://kb.vmware.com/kb/1055 

VMware Security Advisories
https://www.vmware.com/security/advisories 

VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html 

VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html 

VMware Security & Compliance Blog  
https://blogs.vmware.com/security 

Twitter
https://twitter.com/VMwareSRC

Copyright 2024 Broadcom. All rights reserved.