Supermicro BMC web UI user management (cgi/config_user.cgi, X10DRH-iT): An attacker who gets a logged-in BMC

Impact

An attacker who gets a logged-in BMC administrator to load a page silently gains a permanent administrator account on that BMC. The account persists after the victim's session ends, which converts a transient phishing-grade interaction into standing out-of-band control of the node - power, console, virtual media, and a launch point for the firmware-level bugs elsewhere in this list. In fleets where one operator's browser session spans many BMCs, a single page load can seed accounts across dozens of controllers. BIOS 2.0a and IPMI firmware 03.40 - no CSRF protection on the call that creates administrator accounts.

Who can reach it

No network position on the management VLAN needed by the attacker directly - instead they need a BMC administrator with an active session to visit attacker-controlled content. That is an unusually low bar in datacenter operations, where staff routinely have BMC tabs open alongside general browsing.

What to do

Firmware flash to BMC 03.88 or later and BIOS 3.2 or later on X10DRH-iT. Beyond the flash, the durable control is operational rather than technical: BMC administration should happen from a dedicated management workstation or bastion that does not browse the general internet, and BMC accounts should be audited on a schedule so that an injected administrator gets caught. Audit existing BMC user lists now - this bug leaves evidence, in the form of accounts nobody created.

References