CVE-2024-22250: VMware EAP Session Hijack Vulnerability

CVE-2024-22250 Overview

CVE-2024-22250 is a session hijacking vulnerability in the deprecated VMware Enhanced Authentication Plug-in (EAP). This vulnerability allows a malicious actor with unprivileged local access to a Windows operating system to hijack a privileged EAP session when initiated by a privileged domain user on the same system. The vulnerability is classified under CWE-384 (Session Fixation), indicating improper session management that enables unauthorized session access.

Critical Impact

A low-privileged local attacker can escalate privileges by hijacking authenticated sessions of domain administrators, potentially gaining full access to VMware infrastructure and connected systems.

Affected Products

• VMware Enhanced Authentication Plug-in (EAP) - Deprecated
• Windows systems with EAP installed
• VMware vSphere environments using EAP for authentication

Discovery Timeline

• February 20, 2024 - CVE-2024-22250 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-22250

Vulnerability Analysis

This session hijacking vulnerability exists within the deprecated VMware Enhanced Authentication Plug-in, a browser-based component that was previously used to provide integrated Windows authentication and smart card functionality for vSphere environments. The vulnerability stems from improper session management within the EAP component.

When a privileged domain user initiates an EAP authentication session on a Windows system, the session handling mechanism fails to properly isolate and protect the authenticated session. This allows an unprivileged local user on the same system to intercept and hijack the privileged session.

The attack requires local access to the target Windows machine and depends on a privileged domain user initiating an EAP session. However, the attacker does not need elevated privileges to exploit this flaw, making it particularly dangerous in shared computing environments or terminal server deployments where multiple users access the same system.

Root Cause

The root cause of CVE-2024-22250 is improper session management in the VMware Enhanced Authentication Plug-in. The vulnerability falls under CWE-384 (Session Fixation), indicating that the EAP component does not adequately protect session tokens or authentication state from being accessed or manipulated by other local users on the same system. This design flaw allows session hijacking when proper session isolation is not enforced between different user contexts on the Windows operating system.

Attack Vector

The attack vector for this vulnerability is local, requiring the attacker to have unprivileged access to the same Windows system where a privileged domain user is using the EAP. The attack scenario typically involves:

1. An attacker gains unprivileged local access to a Windows workstation or server with EAP installed
2. The attacker monitors for or waits until a privileged domain user initiates an EAP authentication session
3. The attacker exploits the session management flaw to hijack the privileged session
4. Once hijacked, the attacker inherits the privileges of the domain user, potentially including administrative access to VMware vSphere environments

The vulnerability is particularly concerning in enterprise environments where the deprecated EAP may still be deployed, and where privileged administrators regularly access VMware infrastructure from shared systems.

Detection Methods for CVE-2024-22250

Indicators of Compromise

• Unexpected EAP session activity from non-administrative user accounts
• Multiple concurrent EAP sessions originating from the same Windows system under different user contexts
• Anomalous authentication events in vSphere logs following local user logons
• Process injection or handle manipulation events targeting EAP-related processes

Detection Strategies

• Monitor Windows security event logs for suspicious local logon activity preceding vSphere administrative actions
• Implement endpoint detection rules to identify unauthorized access to EAP session tokens or memory spaces
• Audit vSphere authentication logs for sessions that correlate with non-administrative local user activity
• Deploy behavioral analysis to detect privilege escalation patterns involving EAP components

Monitoring Recommendations

• Enable detailed logging for VMware EAP components and Windows authentication events
• Configure SIEM rules to correlate local user logons with subsequent vSphere administrative access
• Monitor for the presence of the deprecated EAP component across enterprise endpoints
• Establish baselines for normal EAP usage patterns to identify anomalous session behavior

How to Mitigate CVE-2024-22250

Immediate Actions Required

• Uninstall the deprecated VMware Enhanced Authentication Plug-in from all Windows systems immediately
• Audit all endpoints to identify systems with EAP installed using inventory management tools
• Restrict local access to systems where EAP cannot be immediately removed
• Migrate to supported authentication methods for VMware vSphere environments

Patch Information

VMware has deprecated the Enhanced Authentication Plug-in and recommends complete removal rather than patching. Organizations should transition to alternative authentication mechanisms supported by VMware. For detailed guidance, refer to the VMware Security Advisory VMSA-2024-0003.

The recommended approach is to:

• Remove the in-browser plugin (VMware Enhanced Authentication Plug-in 6.7.0)
• Remove the Windows service (VMware Plug-in Service)

Workarounds

• Disable the VMware Plug-in Service on Windows systems where immediate uninstallation is not possible
• Implement strict access controls to limit which users can log on locally to systems with EAP installed
• Avoid using shared workstations or terminal servers for administrative VMware access
• Configure firewall rules to restrict EAP communication until removal is complete

# Stop and disable VMware Plug-in Service on Windows
sc stop "VMware Plug-in Service"
sc config "VMware Plug-in Service" start=disabled

# Verify service is disabled
sc query "VMware Plug-in Service"