CVE-2022-34436 - Dell iDRAC8 Firmware Lock-Down Bypass Vulnerability in Racadm

Recently, a critical vulnerability with CVE-2022-34436 has been discovered in Dell iDRAC8 firmware version 2.83.83.83 or earlier, which may allow high privileged attackers to bypass the firmware lock-down configuration and perform a firmware update. This potentially exposes sensitive infrastructure to unauthorized updates and possible malicious activities. In this blog post, we will discuss the details of this vulnerability, how it can be exploited, and possible mitigations.

Vulnerability Details

Dell Integrated Dell Remote Access Controller (iDRAC) is a firmware solution that enables remote system management, monitoring, and troubleshooting on Dell servers. The affected product, Dell iDRAC8, primarily deals with version 2.83.83.83 and earlier. The improper input validation vulnerability is present in the Racadm component when the firmware lock-down configuration is set. Racadm is a command-line utility used to configure and manage iDRAC functionalities.

Exploit Details

An attacker with high privileges can potentially exploit this vulnerability by sending a crafted HTTP request to the target Dell iDRAC8 instance. When the firmware lock-down configuration is set (usually by the device administrator as a security measure to prevent unauthorized updates), the expected behavior is that only authorized personnel can update the firmware. However, due to this vulnerability, an attacker can bypass this restriction and perform a firmware update, potentially injecting malicious code into the system.

Here is an example of a malicious payload that can be used to exploit the iDRAC8 vulnerability

POST /sysmgmt/2015/bmc/firmware HTTP/1.1
Host: targetiDRAC_IP_address
User-Agent: curl/7.55.1
Accept: */*
Content-Length: [Payload_Length]
Content-Type: application/x-www-form-urlencoded

--data-binary '@firmware-image-file'

Before executing the payload, make sure to replace the targetiDRAC_IP_address with the IP address of the vulnerable iDRAC8 instance and set the correct Payload_Length value.

Original References

Below are some links to the original advisory and vulnerability details. We recommend reading these sources to understand the full extent of the vulnerability and its implications:

1. Dell Advisory on the iDRAC8 vulnerability: https://www.dell.com/support/home/en-us/drivers/DriversDetails?driverid=79tpy

2. Common Vulnerabilities and Exposures (CVE) briefing on the CVE-2022-34436 vulnerability: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34436

Mitigation and Recommendations

As a possible mitigation to protect your Dell iDRAC8 instance from this vulnerability;

1. Update your iDRAC firmware to the latest version 2.83.83.83 or later. Dell has provided a patch to address this vulnerability: https://www.dell.com/support/home/en-us/drivers/DriversDetails?driverid=79tpy

Ensure that access to the iDRAC interface is restricted to trusted networks and users only.

3. Regularly monitor your iDRAC instances for unauthorized activity and apply security best practices for server management infrastructure.

In conclusion, CVE-2022-34436 is a critical vulnerability in the Dell iDRAC8 firmware that enables attackers to bypass the firmware lock-down configuration and perform unauthorized firmware updates. In light of this, it is essential to keep your iDRAC8 instances updated, restrict access, and follow security practices to safeguard your infrastructure from potential exploitation.

Timeline

Published on: 01/18/2023 12:15:00 UTC
Last modified on: 01/26/2023 16:06:00 UTC