Dell OpenManage Enterprise (code injection): A low-privileged remote user injects code into OME and executes

Impact

A low-privileged remote user injects code into OME and executes it. OME manages iDRACs fleet-wide, so code execution there means credentialed access to every BMC it manages.

Who can reach it

Authenticated low-privilege user of the OME web console, with interaction.

What to do

Upgrade OME past 4.1. Application upgrade with a service restart. Treat OME as tier-0: it holds fleet-wide BMC credentials, so compromise there is equivalent to compromising every server it manages.

References