CVE-2024-22245: VMware EAP Authentication Bypass Flaw

CVE-2024-22245 Overview

CVE-2024-22245 is a critical vulnerability affecting the deprecated VMware Enhanced Authentication Plug-in (EAP). This security flaw enables arbitrary authentication relay and session hijack attacks, allowing a malicious actor to trick a target domain user with EAP installed in their web browser into requesting and relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs).

The vulnerability exploits improper authentication mechanisms within the EAP browser plugin, which was designed to provide seamless Windows-based authentication for vSphere environments. When successfully exploited, an attacker can leverage the victim's authenticated session to access arbitrary services within the Active Directory domain.

Critical Impact

Successful exploitation allows attackers to relay authentication credentials and hijack user sessions, potentially gaining unauthorized access to any Active Directory service the victim has permissions to access.

Affected Products

• VMware Enhanced Authentication Plug-in (EAP) - All versions (deprecated)
• VMware vSphere environments utilizing EAP for authentication
• Windows systems with the EAP browser plugin installed

Discovery Timeline

• 2024-02-20 - CVE-2024-22245 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-22245

Vulnerability Analysis

This vulnerability falls under CWE-287 (Improper Authentication), representing a fundamental flaw in how the VMware Enhanced Authentication Plug-in validates and processes authentication requests. The attack chain requires user interaction, where a victim with the EAP plugin installed must be tricked into visiting a malicious web page or clicking a crafted link.

Once triggered, the vulnerability allows the attacker to abuse the victim's authenticated browser session to request Kerberos service tickets for arbitrary Service Principal Names (SPNs) within the Active Directory environment. These tickets can then be relayed to target services, effectively allowing the attacker to impersonate the victim and access resources they are authorized to use.

The network-based attack vector combined with the scope change characteristic means that a successful exploit can impact resources beyond the vulnerable component itself, extending the potential damage across the entire Active Directory domain.

Root Cause

The root cause stems from improper authentication handling within the VMware Enhanced Authentication Plug-in. The plugin fails to adequately validate the origin and legitimacy of authentication requests, allowing external actors to trigger authentication flows that should only be initiated by trusted vSphere components. This design flaw in the deprecated plugin enables the relay of Kerberos tickets to arbitrary SPNs rather than restricting requests to legitimate vSphere services.

Attack Vector

The attack leverages a network-based vector requiring user interaction. An attacker must craft a malicious web page or link that, when accessed by a victim with the EAP plugin installed, initiates an authentication relay attack. The attack flow typically involves:

1. Attacker creates a malicious website or delivers a crafted link to the target
2. Victim with EAP plugin installed visits the malicious page
3. The malicious page triggers the EAP plugin to request Kerberos service tickets
4. Tickets are requested for attacker-specified SPNs rather than legitimate vSphere services
5. Attacker captures and relays these tickets to access target Active Directory services

The vulnerability is particularly dangerous because it operates transparently to the user and leverages existing authenticated sessions within the Windows domain environment.

Detection Methods for CVE-2024-22245

Indicators of Compromise

• Unusual Kerberos TGS-REQ requests originating from user workstations for SPNs not associated with typical vSphere operations
• Unexpected authentication events in Active Directory logs correlating with user browser activity
• Service ticket requests for uncommon or administrative SPNs from endpoints with EAP installed

Detection Strategies

• Monitor Kerberos traffic for anomalous service ticket requests, particularly TGS-REQ packets targeting unusual SPNs
• Implement browser activity correlation with Active Directory authentication logs to identify suspicious relay patterns
• Deploy endpoint detection rules to identify the presence of the deprecated VMware Enhanced Authentication Plug-in

Monitoring Recommendations

• Enable detailed Windows Security event logging for Kerberos authentication events (Event IDs 4768, 4769, 4770)
• Configure SIEM alerts for service ticket requests from endpoints known to have EAP installed
• Implement network traffic analysis for Kerberos relay patterns indicating authentication abuse

How to Mitigate CVE-2024-22245

Immediate Actions Required

• Remove the deprecated VMware Enhanced Authentication Plug-in from all workstations immediately
• Disable and remove the associated VMware Plug-in Service Windows service
• Audit all endpoints within the organization to identify systems with EAP installed
• Transition to supported authentication methods for vSphere environments

Patch Information

VMware has not released a patch for this vulnerability as the Enhanced Authentication Plug-in has been deprecated. The official remediation is complete removal of the EAP plugin and associated Windows service. According to VMware Security Advisory VMSA-2024-0003, organizations should migrate to alternative authentication mechanisms supported by current vSphere releases.

Workarounds

• Uninstall the VMware Enhanced Authentication Plug-in from all browsers and workstations
• Stop and disable the VMware Plug-in Service Windows service to prevent exploitation
• Implement network segmentation to limit the impact of potential authentication relay attacks
• Consider deploying application whitelisting to prevent the EAP plugin from executing

# Remove VMware Enhanced Authentication Plug-in service
sc stop "VMware Plug-in Service"
sc config "VMware Plug-in Service" start=disabled
sc delete "VMware Plug-in Service"

# Verify removal of the EAP browser plugin
# Check installed programs and browser extensions for VMware EAP components