{"uuid": "0f54852d-c1c4-42b3-a91d-54a1081eca57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-40289", "type": "seen", "source": "https://t.me/hacking_Attack/121668", "content": "Black Hat Ethical Hacking\nSupermicro\u2019s BMCs Under Siege, Critical Vulnerabilities Open Doors to Attackers\n\nSupermicro\u2019s BMCs Under Siege, Critical Vulnerabilities Open Doors to Attackers\nPost Views: 14 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA series of critical vulnerabilities has rocked the Intelligent Platform Management Interface (IPMI) firmware for Supermicro baseboard management controllers (BMCs), sending shockwaves through the server management community. These seven flaws, ranging from High to Critical severity and tracked from CVE-2023-40284 to CVE-2023-40290, have raised alarms as they pave the way for privilege escalation and the execution of malicious code on vulnerable systems.\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg6dU2Jj2xSOWZXgGUan14my0jF6hvJQnMrbV4Ykx2rUYVo1sfbhXJ-KGukXS7RZnw43zJMlfIa1epJ4lkzQRS6PDiLqspkDwdDG6tCI4B-ORwPnK7coU9a43BGujl5DJiwGYrfLJnfg5YSlPexulcOqqusDAMkTeaRYDoTfyJiQVEOp39rzeyiuiH9jfJ1/s728-rw-ft-e30/bmc.jpg \n\nBMCs, or baseboard management controllers, are specialized processors integrated into server motherboards, designed to facilitate remote management. Administrators rely on these controllers to monitor crucial hardware metrics, such as temperature, fan speed, and UEFI system firmware updates. An intriguing feature of BMC chips is their ability to remain operational even when the host operating system is offline, making them a potentially lucrative target for deploying persistent malware.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nLet\u2019s delve into the specifics of each vulnerability:\n\n1. \nCVE-2023-40284, CVE-2023-40287, and CVE-2023-40288 (CVSS scores: 9.6): These three cross-site scripting (XSS) vulnerabilities allow remote, unauthenticated attackers to execute arbitrary JavaScript code within the context of a logged-in BMC user.\n\n2. \nCVE-2023-40285 and CVE-2023-40286 (CVSS score: 8.6): Two more XSS flaws open doors for remote, unauthenticated attackers to execute JavaScript code in the context of the logged-in BMC user, either by poisoning browser cookies or local storage.\n\n3. \nCVE-2023-40289 (CVSS score: 9.1): This flaw enables operating system command injection, granting attackers the capability to execute malicious code with administrative privileges. It is deemed critical because it allows authenticated attackers to gain root access, essentially compromising the entire BMC system.\n\n4. \nCVE-2023-40290 (CVSS score: 8.3): A cross-site scripting (XSS) vulnerability that permits remote, unauthenticated attackers to execute arbitrary JavaScript code in the context of the logged-in BMC user. Notably, this flaw is effective when using Internet Explorer 11 on Windows.\nThe gravity of CVE-2023-40289, classified as \u201ccritical\u201d by security experts, cannot be overstated. It provides authenticated attackers with a path to root access, thereby comprehensively compromising the BMC system. This level of privilege opens the door to persistent attacks, even during BMC component reboots, enabling lateral movement within the compromised infrastructure and potential infection of other endpoints.\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhMQ6OJ5wjdEL_d7EnIsxslLVZaEYAnix0gyxlz6DgDkPFkG3QQL7hn-qA2vAHAiOj5GwFc2DRG4aRTabvrQIeBgVDzKOE9MobDcjz5rZKltV2uGd4T3OppDnzSIvnC-yEk-uqTQSgG6n6zuWbrXB4e5I0YijqhMhEmCtyyl-84BePggwTUL17BE36ctcfG/s728-rw-ft-e30/shodan.jpg \n\nThe other six vulnerabilities, particularly CVE-2023-40284, CVE-2023-40287, and CVE-2023-40288, serve as stepping stones for attackers to establish accounts with admin privileges in the web server component of the BMC[...]", "creation_timestamp": "2026-09-01T20:00:46.535858Z"}