CVE-2017-5689

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).

Recent assessments:

theguly at March 02, 2020 9:30am UTC reported:

as stated on CVE details, this vulnerability let an attacker to bypass authentication on AMT and reach web panel as admin.

at first glance this vulnerability looks not that useful, because – at least from my tests – by bypassing authentication you can:

• reboot/shutdown/poweron the host

• boot from alternative devices, for example PXE

• other “useless” stuff

and if in theory running a live system to access original host filesystem to exfiltrate hashes/data could be awesome, i’ve seen no engagement where you can actually reboot a box without heavy issue from the owner. because AMT works also when the host is shutdown, it could be interesting to poweron an inactive host and take full control of it, but we have another options:
(un)fortunately, AMT also let a user to access using KVM, so an attacker can use (or leech at) a running interactive session.

the bypass is very easy, just specify response=“” in Authorization header, and can also be automated on any intercepting proxy like burp or zap, so you could route all your traffic to burp and have the auth bypass

what i’ve tested so far are this blog post, to setup a KVM connection from linux:
<https://www.cyberciti.biz/faq/remotely-access-intel-amt-kvm-linux-desktop/&gt;
and this awesome opensource client:
<https://www.meshcommander.com/meshcommander&gt;

unfortunately, engagement’s time didn’t let me to finish my test.

for a quick vulnerability check:
<https://www.exploit-db.com/exploits/43385&gt;

Assessed Attacker Value: 4
Assessed Attacker Value: 4Assessed Attacker Value: 5