AMI MegaRAC SPx (SPX REST API): Shell command injection through the BMC's REST API

CVSS 7.2CVE-2023-34343Firmware, BMC & network fabricAMI-SA-2023005NVIDIA OSR reviewcurated

Impact

Shell command injection through the BMC's REST API. An administrative BMC user gets a root shell on the management controller's Linux - which is a large step up from what the web UI lets them do, because from a BMC shell the attacker can write firmware, install a persistent implant in the BMC's own flash, and pivot to the host. The gap between 'has a BMC admin password' and 'owns the node forever' closes here.

Who can reach it

Network-reachable REST API with an administrative BMC account. Same shared-credential exposure as the rest of the SPX REST API family: assume any leaked BMC admin password is a fleet-wide credential unless you have proven otherwise.

What to do

Firmware flash to SPx_12.7 / SPx_13.5, out-of-band per node, ODM-gated. Config-only compensations that actually reduce blast radius: unique BMC credentials per node, an allowlist ACL restricting who can reach the BMC web/REST port at all, and logging of BMC authentication to your SIEM so a credential-spray across the management VLAN is visible.

References

https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023005.pdf https://nvd.nist.gov/vuln/detail/CVE-2023-34343

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.