AI Security AI安全 4h ago Updated 1h ago 更新于 1小时前 49

24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login 24,650个互联网暴露的BMC在登录前泄露IPMI密码哈希

Over 36,000 internet-exposed Baseboard Management Controllers (BMCs) are vulnerable to CVE-2013-4786, a 20-year-old IPMI v2.0 flaw that leaks password-derived authentication hashes before login. The vulnerability enables offline brute-force attacks on BMC credentials, with over 30% of exposed hashes recoverable using common wordlists or factory-default patterns. Affected systems include modern Supermicro and HPE servers used in AI data centers, where compromised BMCs pose high risk due to out-of 超过36,000台服务器暴露了IPMI管理接口,其中24,650台存在CVE-2013-4786漏洞,可在登录前泄露密码哈希。 该漏洞允许攻击者离线破解密码,尤其对工厂默认密码和弱口令影响严重,部分可在分钟内被GPU破解。 BMC作为独立于操作系统的带外管理组件,一旦遭控可绕过传统安全防线,持久化驻留并横向移动至多租户AI数据中心。 无官方补丁,建议通过禁用IPMI v1.5、限制访问网络、修改出厂密码及封堵UDP 623端口缓解风险。 威胁行为已实际利用该漏洞,包括勒索软件在HPE iLO页面留下赎金通知,表明攻击者正瞄准基础设施底层。

75
Hot 热度
70
Quality 质量
65
Impact 影响力

Analysis 深度分析

TL;DR

  • Over 36,000 internet-exposed Baseboard Management Controllers (BMCs) are vulnerable to CVE-2013-4786, a 20-year-old IPMI v2.0 flaw that leaks password-derived authentication hashes before login.
  • The vulnerability enables offline brute-force attacks on BMC credentials, with over 30% of exposed hashes recoverable using common wordlists or factory-default patterns.
  • Affected systems include modern Supermicro and HPE servers used in AI data centers, where compromised BMCs pose high risk due to out-of-band management capabilities and multi-tenant infrastructure.
  • No software patch exists for the specification-level flaw; mitigation requires network hardening, password rotation, and restricting BMC access to private networks.
  • Threat actors have already exploited exposed BMCs, including ransomware notes left on HPE iLO interfaces, indicating active exploitation in the wild.

Why It Matters

This vulnerability represents a critical blind spot in modern IT and AI infrastructure security. BMCs operate independently of the host OS and provide deep hardware control, meaning compromise can lead to persistent, undetectable access across entire data centers. As AI workloads increasingly rely on bare-metal GPU clusters, securing these foundational management layers is essential to prevent lateral movement, firmware-level malware, and large-scale credential theft.

Technical Details

  • Vulnerability: CVE-2013-4786 (CVSS 7.5) – Information disclosure in IPMI v2.0 specification allowing unauthenticated remote access to HMAC-SHA1 authentication codes derived from passwords during RAKP handshake.
  • Exploitation Mechanism: Attackers send requests to UDP port 623 (IPMI default) to receive RAKP response messages containing HMAC values computed with the account’s password and known session parameters, enabling offline password guessing without triggering lockouts.
  • Scope: 36,872 globally exposed BMCs identified as of May 6, 2026; 24,650 leak authentication material pre-login; 6,240 respond to empty usernames with weak password matches; 2,340 return valid credentials for ADMIN/root accounts using public wordlists.
  • Affected Vendors: Dell (acknowledges inherent spec flaw), Supermicro (evaluating policy changes), HPE (iLO firmware historically targeted by iLOBleed rootkit).
  • Recovery Speed: HPE iLO factory passwords cracked in <1 minute using GPUs; Supermicro unique passwords recovered in ~1 hour despite per-server uniqueness.
  • Network Exposure: Majority located in U.S. (>14,000), followed by Germany, China, Netherlands, UK — indicating widespread misconfiguration in enterprise and cloud environments.

Industry Insight

  • AI Infrastructure Risk Amplification: In shared bare-metal AI clusters, a single compromised BMC can expose multiple tenants’ workloads via lateral movement or firmware manipulation, making BMC hygiene a multi-tenant security imperative.
  • Shift from Patching to Defense-in-Depth: Since no vendor patch exists for the IPMI spec flaw, organizations must adopt zero-trust network segmentation, disable legacy protocols (IPMI 1.5), enforce strong provisioning policies, and monitor UDP 623 traffic.
  • Emerging Exploitation Trend: Presence of ransomware notes on exposed iLO interfaces confirms real-world targeting; this signals a shift from theoretical risk to active commoditization of BMC exploits in cybercrime toolkits.

TL;DR

  • 超过36,000台服务器暴露了IPMI管理接口,其中24,650台存在CVE-2013-4786漏洞,可在登录前泄露密码哈希。
  • 该漏洞允许攻击者离线破解密码,尤其对工厂默认密码和弱口令影响严重,部分可在分钟内被GPU破解。
  • BMC作为独立于操作系统的带外管理组件,一旦遭控可绕过传统安全防线,持久化驻留并横向移动至多租户AI数据中心。
  • 无官方补丁,建议通过禁用IPMI v1.5、限制访问网络、修改出厂密码及封堵UDP 623端口缓解风险。
  • 威胁行为已实际利用该漏洞,包括勒索软件在HPE iLO页面留下赎金通知,表明攻击者正瞄准基础设施底层。

为什么值得看

本文揭示了一个长期存在但被严重低估的基础设施安全风险:IPMI协议中的设计缺陷导致大量服务器暴露在远程密码暴力破解之下。随着AI数据中心规模扩大且多为共享裸机环境,单个BMC沦陷可能波及多个租户,构成重大合规与业务连续性威胁。

技术解析

  • CVE-2013-4786是IPMI v2.0规范层面的信息泄露漏洞,攻击者无需认证即可通过UDP 623端口获取RAKP响应中的HMAC-SHA1值,用于离线密码猜测。
  • BMC(基板管理控制器)运行在独立于主OS的带外通道上,拥有硬件级控制权,可执行电源管理、固件更新、远程控制台等操作,是数据中心运维的核心组件。
  • 实测显示,HPE iLO出厂密码可用现代GPU在一分钟内破解,Supermicro唯一分配密码约需一小时;超30%的泄露哈希对应可恢复弱口令或符合机箱贴纸格式的模式化密码。
  • 攻击流程为:扫描公网开放UDP 623 → 发送RAKP请求获取HMAC → 使用本地字典/暴力工具比对哈希 → 成功登录BMC控制系统。
  • 厂商如Dell确认此为规范固有缺陷,无法打补丁;Supermicro承诺未来改进默认密码策略,但未提供临时缓解方案。

行业启示

  • AI基础设施安全必须从“应用层下沉至硬件管理层”,BMC等带外控制器应纳入零信任架构,禁止直接面向互联网暴露,强制走专用管理网段。
  • 企业需立即开展资产盘点,识别所有公网可达的IPMI/RMCP+服务,实施端口封锁、访问控制列表(ACL)、多因素认证(若支持)及定期密码轮换机制。
  • 供应链安全审查应包含固件与管理接口的安全性评估,优先选择支持Redfish替代IPMI、具备安全启动与加密通信能力的新型管理平台,逐步淘汰老旧协议。

Disclaimer: The above content is generated by AI and is for reference only. 免责声明:以上内容由 AI 生成,仅供参考。

Security 安全