Lenovo XClarity Administrator (LXCA) - single sign-on to XCC: Where LXCA acts as the single sign-on provider for XCC

Impact

Where LXCA acts as the single sign-on provider for XCC, an attacker who gets an authenticated LXCA user to click a crafted URL can intercept that user's XCC session. The stolen session is a live, authenticated connection to a node's service processor, carrying whatever privileges the victim held - typically enough for power control, Virtual Media and console. The interesting property is that SSO, which operators deploy to reduce credential sprawl across BMCs, becomes the mechanism that spreads one phished click into out-of-band access. Affects LXCA before 4.1.

Who can reach it

Requires an authenticated LXCA user to click an attacker-supplied link, and requires that SSO between LXCA and XCC is enabled. The attacker needs no reachability to the management VLAN themselves - the operator's browser session is the bridge.

What to do

Upgrade LXCA to 4.1 or later - a single appliance upgrade, no per-node work, no reboots and no job drain. Config-only mitigation if you cannot upgrade immediately: disable LXCA-to-XCC single sign-on and fall back to direct XCC authentication, accepting the credential-management cost. Independently, administer LXCA and XCC from a dedicated browser profile or privileged access workstation so a crafted link cannot reach a live management session.

References