HPE iLO Amplifier Pack (unauthenticated directory traversal): Unauthenticated directory traversal on the iLO Amplifier

Impact

Unauthenticated directory traversal on the iLO Amplifier Pack appliance, letting an attacker read arbitrary files off it. Amplifier Pack is the fleet-scale iLO management appliance - it inventories every iLO it manages and holds the credentials it uses to reach them. Reading its filesystem without authentication is therefore a credential harvest for the entire out-of-band plane, not a single-host information leak. One unauthenticated request against one appliance can yield the keys to every BMC behind it. Affects versions 1.80, 1.81, 1.90 and 1.95.

Who can reach it

Anything routable to the Amplifier Pack appliance, unauthenticated. In most deployments that means the management network - so the question is which hosts, VPN pools and monitoring systems share a segment with your fleet management appliance.

What to do

Upgrade iLO Amplifier Pack past the affected 1.80-1.95 range - a single appliance upgrade, no per-node work, no reboots and no job drain, so rollout cost is near zero. What is not near zero: if this appliance was reachable while unpatched, assume the iLO credentials it stored are burned and rotate them fleet-wide. That credential rotation is the expensive part, and skipping it leaves the actual exposure open after the appliance is patched.

References