InfoSecBulletin Cybersecurity for mankind
VMware advises users to remove the outdated Enhanced Authentication Plugin (EAP) due to the discovery of a serious authentication relay vulnerability, known as CVE-2024-22245 (CVSS score: 9.6).
A person who intends to harm could deceive a domain user with EAP installed in their web browser. This deception could lead the user to request and relay service tickets for any Active Directory Service Principal Names (SPNs).
Cisco released security updates for two critical security flaws
OpenBAS: Cutting-edge breach and attack simulation platform
Critical Security Flaws Patched in Zyxel Networking Devices
CVE-2024-38811: CEV In VMware Fusion Unveiled
CERT-IN Warns Vulnerabilities in Palo Alto Networks applications
How Malaysia’s Data Centre Industry Poised for Growth
RansomHub exfiltrated data over 210 victims: US alert
Godzilla Fileless Backdoor Exploits Atlassian Confluence flaw
New Cicada ransomware targets VMware ESXi servers
Monday hits two UK bank apps causes outages
VMware published an advisory about vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP). A malicious actor could exploit these vulnerabilities to trick a user with EAP into requesting and relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs). According to the advisory, there are no workarounds for this vulnerability.
The VMware Enhanced Authentication Plugin (EAP) was a software plugin that allowed easy login to vSphere management interfaces using integrated Windows Authentication and smart card functionality on Windows client systems. The plugin was discontinued in 2021 with the release of vCenter Server 7.0u2.
The company fixed a critical session hijack vulnerability in EAP, known as CVE-2024-22250 (CVSS score 7.8).
“A malicious actor with unprivileged local access to a windows operating system can hijack a privileged EAP session when initiated by a privileged domain user on the same system.” continues the advisory.
The vulnerabilities were both reported by Ceri Coburn from Pen Test Partners.
