What is IPMI v2.0?
IPMI stands for Intelligent Platform Management Interface. It’s a standard that allows administrators to manage servers remotely, even if the operating system is down or the machine is powered off. IPMI v2.0 is the most common version and is found in many enterprise-grade servers.
You’ll typically find IPMI enabled on:
- Dell (iDRAC)
- HP (iLO)
- Supermicro
- Lenovo
- Cisco UCS
- Other server-grade hardware with a Baseboard Management Controller (BMC)
These systems often have IPMI enabled by default, especially in data centre or remote server environments.
What Is the Vulnerability?
The IPMI v2.0 Password Hash Disclosure vulnerability (CVE-2013-4786) allows an attacker to extract password hashes from a server without logging in.
Here’s how it works:
- The attacker sends a specially crafted request to the server’s IPMI interface (usually on UDP port 623).
- The server responds with a salted password hash for the requested username.
- The attacker can then crack the hash offline using tools like Hashcat or John the Ripper.
This happens because of a flaw in the RAKP (Remote Authenticated Key-Exchange Protocol) used by IPMI v2.0. The protocol exposes sensitive data before verifying the user’s identity.
What’s the Risk?
- No login required: Attackers don’t need valid credentials to get the hash.
- Offline cracking: Once the hash is captured, it can be cracked without further interaction.
- Full control: If the attacker cracks an admin password, they can reboot the server, change BIOS settings, or install malicious firmware.
- Silent attack: The process doesn’t trigger alerts or logs on most systems.
In short, this vulnerability can lead to complete compromise of the server, especially if IPMI is exposed to the internet or a shared network.
How to Mitigate the Risk
Here are practical steps to reduce or eliminate the risk:
- Disable IPMI over LAN if you don’t need it.
- Restrict access to IPMI interfaces using firewalls or VLANs.
- Use strong, complex passwords for all IPMI accounts.
- Ensure firmware is up-to-date, some vendors have released mitigations.
- Monitor network traffic for unusual activity on UDP port 623.
- Use role-based access control and disable unused accounts.
