AMI MegaRAC SPx (SPX REST API): Path traversal in the BMC REST API letting a low-privilege user read arbitrary files

Impact

Path traversal in the BMC REST API letting a low-privilege user read arbitrary files off the BMC filesystem. That is where the interesting material lives: the shadow file, TLS private keys, SSH host keys, IPMI user database and stored configuration. It is a credential-harvesting step - the attacker takes what they read here and uses it to escalate on this BMC and, because BMC credentials are usually cloned across a fleet, on every sibling node.

Who can reach it

Network-reachable REST API with only a low-privilege BMC account. That is a much lower bar than the admin-required bugs in the same advisory - a read-only telemetry or monitoring account is sufficient, and those are exactly the accounts operators hand out widely and rarely rotate.

What to do

Firmware flash to SPx_12.5 / SPx_13.3 or later, out-of-band per node, ODM-gated. Because the exploit path starts from a low-privilege account, the immediate config-only step is to inventory BMC accounts and delete or rotate every stale, shared or monitoring credential - and to assume any credential material stored on an unpatched BMC has already been read, and rotate it rather than leaving it in place.

References