Broadcom LSI Storage Authority (LSA) / Intel RAID Web Console 3 (RWC3)

Impact

LSA is the agent that fronts the MegaRAID/LSI controller on every server that has one, and it runs as root/SYSTEM with the ability to create, delete and re-initialize virtual drives and to push controller firmware. Sessions are not invalidated properly in Gateway (multi-node) setup, so an attacker who reaches the LSA web service can ride an admin session and drive the RAID controller on any managed node: wipe or re-create arrays under a running tenant, or stage a controller firmware update. Because the controller sits below the OS with DMA to host memory, a firmware push through this path is below-the-OS persistence that a tenant reimage does not remove - it breaks tenant handoff. The sibling issues in the same disclosure are the supporting weaknesses: a bundled vulnerable libcurl, no CSP, no SameSite on the session cookie, SHA-1 ciphersuites and obsolete TLS versions on the management listener, and world-readable log files.

Who can reach it

Any host that can reach the LSA HTTPS listener (default TCP 2463) on the management or provisioning network. In Gateway mode one LSA instance manages many nodes, so one reachable management endpoint fans out to the whole fleet. No valid credentials are needed to abuse the session-handling flaw; the weak TLS and cookie defaults widen it to on-path and browser-side attackers.

What to do

Software-only: upgrade LSA / Intel RWC3 to 7.017.011.000 or later on every managed node and on the Gateway. No controller firmware flash and no array downtime - restarting the LSA service is enough. The real cost is that this agent is installed by OEM tooling on every server with a Broadcom controller, and Dell/HPE/Supermicro/Intel ship their own rebadged LSA build months behind Broadcom, so you often cannot take the upstream package. Interim control: bind LSA to loopback or a dedicated management VLAN and firewall 2463 off the tenant and provisioning networks; if you do not use the web UI, uninstall LSA and drive the controller with StorCLI from a config-managed path instead.

References