VMware Urges Users to Remove Depreciated Vulnerable Software

Summary

VMware has released an advisory regarding two vulnerabilities, CVE-2024-22245 (CVSSv3:9.6) and CVE-2024-22250 (CVSSv3:7.8) which impact the VMware Enhanced Authentication Plug-in (EAP). They are arbitrary authentication relay and session hijack vulnerabilities which exist in the depreciated EAP plug-in. VMware advises users to remove this component from impacted environments. These vulnerabilities were attributed to VMware to Ceri Coburn from Pen Test Partners as the reporter of them.

Impact Assessment

According to VMware the attack vector varies between these two vulnerabilities. CVE-2024-22245, the arbitrary authentication relay vulnerability, requires a malicious actor to trick a target domain user with the affected application installed in their web browser to request relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs). CVE-2024-22250, the session hijack vulnerability, requires a malicious actor with unprivileged local access to a windows OS system can hijack a privileged EAP session when initiated by a privileged domain user on the same system.

What It Means for You

Check your organization’s software inventory for any instances of this VMware EAP software and remove it if present. As it is depreciated it will no longer be receiving updates and is currently vulnerable and it is advised by the vendor to delete it.

Remediation

VMware has supplied an article for a complete guide to removing this software to remediate these vulnerabilities. Refer to their KB 96442 for information on how to do so.

Business Implications

Depreciated or EoL software are always at risk of exploitation as they will never receive security updates. If exploited this vulnerability could damage your organizations reputation as there was not enough expediency in removing this software which depreciated in 2021. This is not to mention the potential loss of data and incident response costs because of an attacker exploiting the vulnerabilities as well.

Access Point Technology Recommends

Follow vendor recommendations: Remove the depreciated software per vendor instructions.

Have a plan for EoL or Depreciated software: Make sure your organization has a plan for removing or mitigating the risk of depreciated software.

Associated Bulletins

https://www.vmware.com/security/advisories/VMSA-2024-0003.html

‍