IBM OpenBMC OP910 web UI (phosphor-webui lineage): Stored/reflected script injection in the BMC web interface

Impact

Stored/reflected script injection in the BMC web interface. The victim is your own operator: an admin opens the BMC console and the injected script runs with their authenticated session, which is a session that can power-cycle nodes, mount virtual media and push firmware. On a GPU fleet the practical scenario is an attacker who has read-only or low-privilege access to one BMC planting the payload and waiting for an administrator to visit, converting a foothold into administrative control without ever cracking a password.

Who can reach it

Requires getting attacker-controlled content into a field the BMC web UI renders, plus an administrator subsequently loading that page. Network access to the BMC web interface.

What to do

Fixed in later OP910 firmware - per-node system firmware update, maintenance window. Cheap compensating control: do not browse BMC web UIs from the same browser profile you use for anything else, and prefer Redfish API calls over the web UI for routine operations. Fleet-scale automation against Redfish rather than humans clicking through per-node web UIs removes the victim this bug needs.

References