AMI SPx BMC Redfish Host Interface Authentication Bypass Vulnerability (CVE-2024-54085) Security Advisory

1. Vulnerability Overview & Root Cause

CVE-2024-54085 is a critical authentication bypass vulnerability in the Redfish Host Interface of AMI's SPx BMC firmware. The root cause lies in an improper authentication mechanism (CWE-290) where the BMC fails to properly validate the identity of requests originating from or directed to the Redfish Host Interface, allowing attackers to spoof trusted entities.

2. Exploitation Mechanics & Attack Scenario

Redfish is an industry-standard RESTful API used for modern platform management. In a successful exploitation scenario, an attacker sends crafted HTTP requests to the Redfish Host Interface. Due to the validation flaw, the BMC processes these requests as if they came from an already authenticated or trusted internal channel. This grants the attacker full administrative access to the Redfish API without requiring valid credentials.

3. Infrastructure & Business Impact

With a CVSS score of 9.8, this vulnerability poses an extreme risk and has been added to the CISA KEV catalog due to active exploitation in the wild. Successful exploitation allows attackers to compromise the confidentiality, integrity, and availability of the host system. Attackers can perform arbitrary power actions, modify firmware, install persistent implants, or completely brick the physical server, causing catastrophic operational disruption.