Vulnerabilities in Baseboard Management Controllers (BMCs) pose an underestimated risk to enterprise servers. New research by security firm runZero shows that more than half of publicly accessible BMCs contain at least one critical vulnerability. Some of these have been known since 2013. However, they appear to still be widespread.
BMCs are separate microcontrollers on the motherboard of virtually every enterprise server. They have their own firmware, network stack, and IP address. They enable remote management, even when the server itself is powered off or unresponsive. It is precisely this autonomous nature that makes them attractive to attackers seeking long-term access to a server environment.
Firmware researcher HD Moore, founder and CEO of runZero and known as the creator of the Metasploit Framework, presented his findings at Black Hat USA. The research focuses on BMC implementations from vendors including HPE, Dell, Supermicro, AMI, Fujitsu, H3C, and OpenBMC. According to runZero, the vulnerabilities allow for unauthorized control over the management controller, enabling attackers to bypass security measures and move laterally through an infrastructure.
Notably, in addition to new vulnerabilities, Moore also discovered flaws that have been known for over a decade. In particular, the architecture of the IPMI (Intelligent Platform Management Interface) protocol remains a weak link.
More than 86,000 systems examined
To determine the scope of the problem, runZero conducted two large-scale scans. These scans identified over 86,000 publicly accessible BMCs. Of these systems, more than 54 percent contained at least one critical vulnerability. In addition, approximately 75,000 systems were still found to be vulnerable to CVE-2013-4786, a flaw in the IPMI 2.0 authentication protocol that allows offline cracking of administrator passwords.
A second scan of corporate networks examined 126,761 BMCs. Of these, nearly 29 percent also contained one or more critical vulnerabilities, Ars Technica reports. According to Moore, this represents a substantial, yet often barely monitored, attack surface within enterprise environments.
Authentication and firmware vulnerabilities
The discovered vulnerabilities fall into several categories. For example, runZero found flaws in IPMI authentication that allowed attackers to bypass security controls. Other vulnerabilities exploit predictable session identifiers, insufficient controls on encrypted sessions, or flaws in the SSH management service that can be exploited even before authentication. Moore also discovered that some vendors do not adequately protect firmware against tampering or include cryptographic keys that can be extracted from publicly available firmware files.
Furthermore, many of these vulnerabilities can be combined. An attacker who gains limited access through a single vulnerability can then exploit additional vulnerabilities to gain permanent control over the BMC.
OOBscan is designed to help administrators
In conjunction with the research, runZero introduced the open-source tool OOBscan. This tool enables organizations to scan their infrastructure for vulnerable BMCs and IPMI configurations. In addition, the company recommends not exposing management interfaces directly to the internet, disabling or shielding IPMI wherever possible, and implementing a structured patching policy for BMC firmware.
According to Moore, BMC security has been neglected for years, even though these components are deeply embedded in the infrastructure and offer extensive management capabilities. His conclusion is therefore that the software quality and architecture of many BMC implementations still fall short of the security requirements demanded by modern data center environments.