PT-2019-15898 · Supermicro · Supermicro X8Sti-F

Publicado 2019-12-08 · Atualizado 2019-12-18 · CVE-2019-19642

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68

Description The issue allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This is achieved by sending a POST request to the "/rpc/setvmdrive.asp" API endpoint with shell metacharacters in the ShareHost or ShareName variables. The attacker can achieve a persistent backdoor.

Recommendations For SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, consider disabling the Virtual Media feature until a patch is available to prevent OS Command Injection attacks. Restrict access to the "/rpc/setvmdrive.asp" API endpoint to minimize the risk of exploitation. Avoid using the ShareHost and ShareName variables in the affected API endpoint until the issue is resolved.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-19642

Produtos afetados

Supermicro X8Sti-F

Referências · 3

• 🔥 https://dark-sec.net/2019/12/supermicro-ipmi-exploitation.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-19642 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19642 · Nota de Segurança