Thousands of servers are vulnerable through their motherboard management controllers

Hidden inside virtually every enterprise server board is a tiny separate computer — the baseboard management controller (BMC). It has its own firmware, network stack and IP address, and it runs even when the server itself is powered off or hung. Administrators use the BMC to remotely monitor, reboot, install updates and even reinstall the OS. It is precisely this “out-of-band” independence that makes the controllers a tempting target.

The risks have been flagged since at least 2013, and judging by the talk HD Moore (head of the company runZero) gave at Black Hat, little has changed since. The researcher found more than a dozen new vulnerabilities in controllers from HPE, Supermicro, Avocent, Huawei, Lenovo, Dell and others, and some of the problems he raised back in 2013 are still alive. He calls the BMC a “ubiquitous, poorly controlled and barely patched parallel attack surface,” reachable both from the internet and inside corporate networks.

The scale of the problem

Moore ran two mass scans. The external one turned up more than 86,000 controllers with a management service exposed to the internet; over 54% of them contained at least one critical vulnerability. As many as 75,000 devices are still vulnerable to CVE-2013-4786 — a flaw in the IPMI 2.0 authentication protocol that allows offline brute-forcing of administrator account passwords. The internal scan of 126,761 controllers revealed critical vulnerabilities in nearly 29%.

What exactly breaks

Moore is keeping the details under wraps until patches ship, but he described the classes of problems: authentication bypass in the IPMI handshake; acceptance of unencrypted commands within a supposedly protected session (the device decides whether to verify a packet based on the attacker's own header); predictable session identifiers generated from counters or clocks rather than a cryptographically strong source; pre-authentication memory corruption in the SSH service; unsigned firmware that an administrator can swap out for a backdoor; and, finally, keys and factory passwords with a small search space that can be pulled straight out of publicly available firmware. HPE fared worst of all on default passwords.

A reminder that this is no mere theory comes from a 2021 case: the ILObleed implant infected HPE servers with wiper firmware that destroyed data and survived an OS reinstall and even a disk swap. Last year CISA added a critical vulnerability in AMI's BMC to its list of actively exploited flaws.

Moore has released an open-source tool, OOBscan, to inventory vulnerable controllers across a server fleet. Beyond scanning, he advises setting long, unique logins and complex passwords, disabling IPMI and KCS wherever possible, and isolating each BMC's network interface. “The BMC is still an underrated risk,” the researcher concludes. “The ecosystem lags badly in code quality and architecture.”

Source: Ars Technica