CVE-2024-22245: Authentication Relay in VMware Enhanced Authentication Plug-in

The impact of CVE-2024-22245 is significant due to its potential to bypass authentication mechanisms and facilitate unauthorized access to Active Directory resources. An attacker could craft a malicious web page or link that, when visited by a user with EAP installed, triggers the relay of service tickets. These tickets, if successfully relayed, could grant the attacker access to sensitive data, systems, and services within the Active Directory domain. This could lead to lateral movement, data exfiltration, and complete compromise of the environment. The vulnerability's ease of exploitation, coupled with the widespread use of Active Directory, makes it a high-priority concern.

1. Reserved2024-01-08
2. Published2024-02-20
3. Modified2024-08-27
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-22245 is to disable the VMware Enhanced Authentication Plug-in (EAP) entirely, as it is a deprecated component. If disabling EAP is not immediately feasible, restrict access to Active Directory Service Principal Names (SPNs) to prevent unauthorized ticket relay. Implement strict network segmentation to limit the attacker’s ability to reach users with EAP installed. Regularly review and audit Active Directory permissions to identify and remediate any excessive privileges. After disabling EAP or implementing SPN restrictions, verify the change by attempting to access Active Directory resources through a browser that previously had EAP enabled; access should be denied.