AMI MegaRAC SPx (BMC web interface, HTTP header handling): CRLF sequences are not neutralised in HTTP headers, so

Impact

CRLF sequences are not neutralised in HTTP headers, so an attacker can split responses and inject headers of their choosing. Against a BMC web UI the payoff is session and cache manipulation against an administrator's browser - poisoning what the admin sees, planting cookies, or setting up a follow-on credential capture. It is an integrity bug that is useful as a stepping stone toward hijacking an admin's BMC session rather than a direct takeover.

Who can reach it

Adjacent network with a low-privilege BMC account. Requires an administrator to subsequently interact with the BMC web interface for the payoff, so it depends on your ops team actually using the web UI - which most do for KVM and console access.

What to do

Firmware flash to SPx_12.5 / SPx_13.3 or later, out-of-band per node, ODM-gated. Low priority relative to the rest of this cluster, so fold it into the same flash campaign rather than scheduling separately. Config-only reduction: reach BMC web UIs only from a hardened jump host with a dedicated browser profile, so an admin session cannot be crossed with anything else.

References