Supermicro BMC (IPMI web interface, command injection): Command injection that turns a BMC administrator account

Impact

Command injection that turns a BMC administrator account into shell on the BMC's own Linux. That matters more than it sounds: BMC admin is a constrained management role, whereas BMC shell means arbitrary firmware modification, access to the host over the internal bridges, and a place to hide that no host-side agent can inspect. Chained after any of the XSS bugs in the same batch, an operator merely visiting a page is enough to reach it.

Who can reach it

An authenticated BMC administrator - or, realistically, an attacker who chained an XSS in the same firmware to ride an admin's session. Requires network reach to the BMC web interface.

What to do

BMC firmware flash per board, out-of-band. Supermicro fixes ship per-SKU and lag disclosure, so expect a long tail of boards with no image. Interim controls that work today: keep the BMC web UI off any routable network, require a jump host, and stop using shared BMC admin credentials across the fleet so one compromise is not fleet-wide.

References