ASUS BMC's firmware: command injection - Modify user’s information function

Vulnerability

The ASUS BMC firmware's web management page contains a command injection vulnerability in the "Modify user's information" function. The specific parameter is not properly filtered, allowing injection of system commands. Affected firmware versions include Z10PR-D16 1.14.51, ASMB8-iKVM 1.14.51, and Z10PE-D16 WS 1.14.2 [1].

Exploitation

An attacker must first obtain administrator privileges on the BMC web interface. With network access to the management page, the attacker can send a crafted HTTP request to the vulnerable function, injecting arbitrary operating system commands via the unfiltered parameter [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands with the privileges of the BMC firmware. This can lead to full compromise of the BMC, potential access to the host system, and disclosure or modification of sensitive data [1].

Mitigation

ASUS has released fixed firmware versions: Z10PR-D16 1.16.1, ASMB8-iKVM 1.16.1, and Z10PE-D16 WS 1.16.1. Users should update to these versions immediately. No workaround is documented in the available reference [1].