Broadcom LSA / Intel RWC3: management web UI ships without X-Content-Type-Options and HSTS headers

CVSS 9.8CVE-2023-4338Firmware, BMC & network fabric+1 more CVEscurated

Impact

The vendor split this across 2 ids: the LSA web interface, which manages MegaRAID/LSI controllers on the host, ships with insecure HTTP defaults and sends neither X-Content-Type-Options nor a Strict-Transport-Security policy. On their own these are hardening gaps, not a direct compromise. They make browser-side content-sniffing attacks and TLS-downgrade attacks against an administrator's session easier. Through that session an attacker can reach a service that can reconfigure RAID arrays and stage controller firmware. The record scores both 9.8, but the descriptions name only the missing headers and give no exploitation path.

Who can reach it

An attacker who is on-path between an administrator's browser and the LSA listener on the management network, or who can get content served to an admin's browser session. A logged-in administrator has to take part; no credentials are needed on the attacker's side.

What to do

Upgrade LSA / Intel RWC3 to the fixed release named in Intel SA-00926 and Broadcom's security center (the same release that fixes the rest of this 2023 LSA disclosure), then restart the LSA service. No controller firmware flash or array downtime is described. Until then, keep the LSA listener on a dedicated management VLAN and reach it only over trusted paths.

Also covers 1 CVE

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

CVE-2023-4342

References

https://nvd.nist.gov/vuln/detail/CVE-2023-4338 https://nvd.nist.gov/vuln/detail/CVE-2023-4342 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html https://www.broadcom.com/support/resources/product-security-center

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.