Linuxfabrik monitoring-plugins: redfish checks follow BMC-supplied @odata.id links and leak credentials

Impact

The redfish-* plugins built request URLs by concatenating the operator-supplied base URL with @odata.id links taken from the BMC's own responses, so a malicious or already-compromised BMC can point the next authenticated request anywhere and collect the X-Auth-Token or HTTP Basic credential the monitoring host sends. In a datacenter that credential is almost never per-chassis: the same Redfish service account is pushed to every BMC in the fleet, so one tampered or compromised node yields management-plane access to the rest - power control, virtual media, firmware update, serial-over-LAN. Monitoring hosts also poll continuously, so the attacker does not need to win a race. Affects 6.0.0 and earlier.

Who can reach it

Requires control of a BMC that the monitoring host polls, or a position to tamper with its Redfish responses - typically someone already on the management VLAN or holding one BMC. No authentication to the monitoring host itself is needed; the plugin brings the credential to the attacker.

What to do

Update the monitoring-plugins package to a release containing commit ffb0a813 (the fix stops trusting response-supplied links) and the next check cycle picks it up - no restart of the Icinga or Nagios daemon beyond the normal package update. Then rotate the Redfish monitoring credential on every BMC, because the advisory does not establish whether it was already taken; if the fleet shares one account, that rotation is the real work. Keep the BMC network on its own VLAN reachable only from the monitoring host.

References

Related entries

• IBM BladeCenter AMM (before 3.66E), IMM (before 1.43), IMM2: The in-band host-to-BMC pivot, with a CVE attached. TheCVE-2014-0860 · IBM BladeCenter AMM (before 3.66E), IMM (before 1.43), IMM2High
• Power Management Controller (PMC) firmware in systems using Intel CSME 11.x/12.0 or Intel SPS 4.x: An administrativeCVE-2018-3643 · Power Management Controller (PMC) firmware in systems using Intel CSME 11.x/12.0 or Intel SPS 4.xHigh
• BMC firmware on Intel server boards, compute modules and systems - SMBus access control: An attackerCVE-2018-3682 · BMC firmware on Intel server boards, compute modules and systems - SMBus access controlHigh
• Intel Xeon system firmware: insufficient input validation lets a privileged local user escalate out of the OSCVE-2019-11137 · Intel Xeon Scalable / Xeon D / E5-E7 v4 / Atom C system firmware (UEFI)High
• GRUB2: Buffer overflow in `grub.cfg` parsing allowing Secure Boot bypass and arbitrary code execution inside GRUBCVE-2020-10713 · GRUB2High
• GRUB2 (direct kernel boot without shim): When GRUB is booted directly by UEFI rather than chained through shim, it doesCVE-2020-15705 · GRUB2 (direct kernel boot without shim)High