AMI MegaRAC SPx (SPX REST API): Shell command injection through the BMC's REST API

Impact

Shell command injection through the BMC's REST API. An administrative BMC user gets a root shell on the management controller's Linux - which is a large step up from what the web UI lets them do, because from a BMC shell the attacker can write firmware, install a persistent implant in the BMC's own flash, and pivot to the host. The gap between 'has a BMC admin password' and 'owns the node forever' closes here.

Who can reach it

Network-reachable REST API with an administrative BMC account. Same shared-credential exposure as the rest of the SPX REST API family: assume any leaked BMC admin password is a fleet-wide credential unless you have proven otherwise.

What to do

Firmware flash to SPx_12.7 / SPx_13.5, out-of-band per node, ODM-gated. Config-only compensations that actually reduce blast radius: unique BMC credentials per node, an allowlist ACL restricting who can reach the BMC web/REST port at all, and logging of BMC authentication to your SIEM so a credential-spray across the management VLAN is visible.

References