AMI MegaRAC SPx (SPX REST API): Path traversal in the BMC REST API letting a low-privilege user read arbitrary files

CVSS 6.5CVE-2023-34345Firmware, BMC & network fabricAMI-SA-2023005NVIDIA OSR reviewcurated

Impact

Path traversal in the BMC REST API letting a low-privilege user read arbitrary files off the BMC filesystem. That is where the interesting material lives: the shadow file, TLS private keys, SSH host keys, IPMI user database and stored configuration. It is a credential-harvesting step - the attacker takes what they read here and uses it to escalate on this BMC and, because BMC credentials are usually cloned across a fleet, on every sibling node.

Who can reach it

Network-reachable REST API with only a low-privilege BMC account. That is a much lower bar than the admin-required bugs in the same advisory - a read-only telemetry or monitoring account is sufficient, and those are exactly the accounts operators hand out widely and rarely rotate.

What to do

Firmware flash to SPx_12.5 / SPx_13.3 or later, out-of-band per node, ODM-gated. Because the exploit path starts from a low-privilege account, the immediate config-only step is to inventory BMC accounts and delete or rotate every stale, shared or monitoring credential - and to assume any credential material stored on an unpatched BMC has already been read, and rotate it rather than leaving it in place.

References

https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023005.pdf https://nvd.nist.gov/vuln/detail/CVE-2023-34345

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.