Supermicro BMC Stack-Based Buffer Overflow Vulnerability on MBD-X13SEDW-F

A stack-based buffer overflow vulnerability has been identified in the Supermicro BMC web function on the MBD-X13SEDW-F motherboard. This vulnerability allows an authenticated attacker to execute arbitrary code on the BMC's firmware operating system. The issue arises in the 'upload_license.cgi' web portal endpoint, where a crafted Content-Type HTTP header can overflow a 128-byte stack buffer, overwrite the return address and registers, and lead to unauthorized code execution.

Impact

Exploitation of this vulnerability allows for a stack-based buffer overflow, where an authenticated attacker can overwrite the return address and registers, potentially leading to arbitrary code execution on the BMC's firmware operating system.

Remediation

Supermicro has developed a BMC firmware update to address this vulnerability. Affected users should check the Supermicro Release Notes for the update.