过时 EAP 浏览器插件中的任意身份验证中继漏洞

The impact of CVE-2024-22245 is significant due to its potential to bypass authentication mechanisms and facilitate unauthorized access to Active Directory resources. An attacker could craft a malicious web page or link that, when visited by a user with EAP installed, triggers the relay of service tickets. These tickets, if successfully relayed, could grant the attacker access to sensitive data, systems, and services within the Active Directory domain. This could lead to lateral movement, data exfiltration, and complete compromise of the environment. The vulnerability's ease of exploitation, coupled with the widespread use of Active Directory, makes it a high-priority concern.

Organizations heavily reliant on Active Directory for authentication and authorization are at significant risk. Environments where users routinely browse untrusted websites or open suspicious links are particularly vulnerable. Shared hosting environments where multiple users share the same infrastructure could also be affected, as the vulnerability resides within the user’s web browser.

• windows / supply-chain:

Get-Process -Name 'EAP'

• linux / server: Check for any VMware-related processes or services that might be related to EAP. • wordpress / composer / npm: N/A - This vulnerability is not related to web application components. • database (mysql, redis, mongodb, postgresql): N/A - This vulnerability is not related to database components. • generic web: Check for any VMware-related plugins or extensions in web browsers.

1. 2024-02-20Disclosure

   disclosure

1. 已保留2024-01-08
2. 发布日期2024-02-20
3. 修改日期2024-08-27
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2024-22245 is to disable the VMware Enhanced Authentication Plug-in (EAP) entirely, as it is a deprecated component. If disabling EAP is not immediately feasible, restrict access to Active Directory Service Principal Names (SPNs) to prevent unauthorized ticket relay. Implement strict network segmentation to limit the attacker’s ability to reach users with EAP installed. Regularly review and audit Active Directory permissions to identify and remediate any excessive privileges. After disabling EAP or implementing SPN restrictions, verify the change by attempting to access Active Directory resources through a browser that previously had EAP enabled; access should be denied.