Attack Chain

1. The attacker probes the target iDRAC web interface at /cgi-bin/login using the LD_DEBUG=files query parameter to confirm the device is vulnerable by observing debug output.
2. The attacker creates a malicious C payload designed to spawn a reverse shell.
3. The payload is cross-compiled for the SH4 architecture using sh4-linux-gnu-gcc to produce a malicious shared object (.so) file.
4. The attacker uploads the malicious library to the target device by sending a POST request to the /cgi-bin/putfile endpoint, which writes the file to /tmp/sshpkauthupload.tmp.
5. The attacker triggers execution by sending a GET request to /cgi-bin/discover with the LD_PRELOAD environment variable set to the path of the uploaded library (/tmp/sshpkauthupload.tmp).
6. The iDRAC dynamic linker loads the malicious library before the application initializes, triggering the constructor function within the library.
7. The injected code executes with root privileges, establishing a reverse shell connection back to the attacker-controlled listener.

Impact

Successful exploitation allows unauthenticated attackers to gain complete control over the iDRAC management controller. This leads to full system compromise, as the attacker can manipulate hardware power states, access stored data, exfiltrate credentials, and potentially pivot into the host operating system or the wider data center network. The vulnerability is highly exploitable, and the widespread use of iDRAC in enterprise environments makes this a significant risk for server infrastructure.

Recommendation

Prioritize the identification of all internet-facing or vulnerable internal iDRAC interfaces.

• Patch all affected Dell iDRAC7 and iDRAC8 devices to firmware version 2.52.52.52 or later immediately.
• Implement strict network segmentation to ensure iDRAC management interfaces are only accessible via trusted, restricted administrative networks.
• Monitor web server access logs for unusual POST requests to /cgi-bin/putfile and GET requests containing LD_DEBUG or LD_PRELOAD query parameters.
• Deploy the provided Sigma rule to detect attempts at exploiting the dynamic linker injection path.