Two vulnerabilities have been found that enable bypassing authentication or injecting malicious code via Redfish remote management interfaces.
CVE-2023-34329 – Authentication Bypass via HTTP Header Spoofing
CVE-2023-34330 – Code injection via Dynamic Redfish Extension interface
Sites should update as soon as possible.
General recommendations on remote management security:
Administrators should make sure that all remote server management interfaces such as Redfish and the BMC subsystems in their environments are not exposed externally. BMC interface access should be restricted to administrative users with Access Control Lists (ACL) in place. Disable default built-in administrative accounts that might be provided by the vendors, and check if your vendor already provided a firmware upgrade that mitigates these vulnerabilities. A unique, well-protected admin account configuration for your management systems is usually a good practice.
Recent Comments