AMI MegaRAC SPx (IPMI handler): Arbitrary file upload and download through the BMC's IPMI handler

Impact

Arbitrary file upload and download through the BMC's IPMI handler. Download gives the attacker the BMC's stored secrets and configuration; upload gives them a way to drop a payload onto the controller's filesystem and, depending on where it lands, get it executed - which is how a credentialed foothold becomes a persistent BMC implant. Availability damage is also on the table: writing over the wrong file bricks the controller.

Who can reach it

Local access to the BMC with high privileges per AMI's vector - i.e. an attacker who already holds a BMC admin credential or has landed on the controller. Its role in a real chain is post-exploitation persistence, not initial access.

What to do

Firmware flash to SPx_12.7 / SPx_13.5, out-of-band per node, ODM-gated. Config-only reduction: disable IPMI-over-LAN so the handler is not reachable from the network at all and drive management through Redfish, accepting that this breaks ipmitool-based provisioning and monitoring tooling. Also worth doing regardless: alert on any BMC firmware or filesystem change, because this class of bug is invisible from the host OS.

References