InfoSecBulletin Cybersecurity for mankind
VMware advises users to remove the outdated Enhanced Authentication Plugin (EAP) due to the discovery of a serious authentication relay vulnerability, known as CVE-2024-22245 (CVSS score: 9.6).
A person who intends to harm could deceive a domain user with EAP installed in their web browser. This deception could lead the user to request and relay service tickets for any Active Directory Service Principal Names (SPNs).
Over 145,000 ICS Across 175 Countries Found Exposed Online
World to see AI powered “human washing machines”
Hacker compromised over 2000 Palo Alto Networks Firewalls
“Forces Penpals” exposed US and UK Military Social Network’s 1 Million Records
CVE-2024-51503
Trend Micro released updates for Deep Security Agent RCE
Apple Releases Patch for two Actively Exploited Zero-Day
Maxar Space Data Leak, Company admit, Investigation ongoing!
GitHub CLI Vulnerability Could Allow RCE
“Sarcoma” ransomware group
Hacker to disclose “Popular Life Insurance” 36 GB of stolen data
BugHunt 2024: A Milestone Cyber security Competition held at Dhaka
VMware published an advisory about vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP). A malicious actor could exploit these vulnerabilities to trick a user with EAP into requesting and relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs). According to the advisory, there are no workarounds for this vulnerability.
The VMware Enhanced Authentication Plugin (EAP) was a software plugin that allowed easy login to vSphere management interfaces using integrated Windows Authentication and smart card functionality on Windows client systems. The plugin was discontinued in 2021 with the release of vCenter Server 7.0u2.
The company fixed a critical session hijack vulnerability in EAP, known as CVE-2024-22250 (CVSS score 7.8).
“A malicious actor with unprivileged local access to a windows operating system can hijack a privileged EAP session when initiated by a privileged domain user on the same system.” continues the advisory.
The vulnerabilities were both reported by Ceri Coburn from Pen Test Partners.
