CVE-2024-54085: Critical Authentication Bypass Vulnerability in AMI MegaRAC BMC

Affected Systems

The vulnerability affects a wide range of server hardware from major manufacturers:

• AMI MegaRAC SPx: versions 12.x up to 12.7 and 13.x up to 13.5
• HPE Cray XD670: versions 1.09, 1.13, 1.17
• Asus RS720A-E11-RS24U: version 1.2.27
• ASRockRack: servers
• Supermicro: servers
• Many other servers with AMI BMC from leading manufacturers

Technical Exploit Detail

The vulnerability is located in the file:

/usr/local/redfish/extensions/host-interface/host-interface-support-module.lua

Attacker Capabilities

After successful exploitation of CVE-2024-54085, the attacker gains full administrative access to the BMC, allowing:

• Remote server management: reboot, shutdown, ISO mounting.
• Malware deployment: installation of ransomware, rootkits at the firmware level.
• Firmware modification: alteration of BIOS/UEFI, installation of persistent backdoors.
• Physical damage: over-voltage attacks, permanent bricking of components.
• Infinite reboot loops: DoS attacks that cannot be stopped remotely.
• Lateral movement: access to the management network, attacks on other BMCs.

Vulnerability Description

CVE-2024-54085 is a critical authentication bypass vulnerability in AMI MegaRAC BMC (Baseboard Management Controller) software. It allows remote attackers to bypass authentication through the Redfish Host Interface, granting full control over the system.