Critical Vulnerabilities in VMware EAP Uncovered — Unraveling CVE-2024–22245

source

Free version here

Published on February 20, 2024, and updated shortly thereafter, CVE-2024–22245 has been a focal point for cybersecurity professionals and organizations worldwide.

CVE-2024–22245 encompasses a duo of alarming vulnerabilities: an Arbitrary Authentication Relay and a Session Hijack vulnerability, both found in the now-deprecated VMware Enhanced Authentication Plug-in (EAP).

These vulnerabilities expose users to severe security risks, potentially allowing malicious actors to bypass authentication mechanisms and hijack user sessions.

Given the critical nature of these vulnerabilities, with a base score of 9.6 on the CVSS scale, understanding and addressing them is paramount for ensuring the security of affected systems.

Before delving deeper into the analysis, let’s briefly outline what to expect in this exploration:

A detailed examination of CVE-2024–22245, including its background and the specific vulnerabilities it comprises.The implications of these vulnerabilities for organizations and individual users.Recommended measures for mitigating the risks posed by these security flaws.

Don’t forget to clap 👏 and follow for more updates on cybersecurity trends and insights!

The VMware Enhanced Authentication Plug-in (EAP) was designed to offer an additional layer of security for accessing VMware’s suite of virtualization products.

(I do not manage to find current deployment statistics on this plugin, so if someone know how to do that, help me in the comment ! :D)

However, with the deprecation of EAP announced in 2021, alongside the release of vCenter Server 7.0u2, the continued use of this plugin has exposed organizations to significant security risks.