Description

Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. This is a Critical severity vulnerability as it allows an unauthenticated attacker to intercept all Redfish BMC traffic including credentials by performing a man-in-the-middle attack, since TLS certificate verification is unconditionally disabled in the base HTTP transport. Dell recommends customers to upgrade at the earliest opportunity.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-10-14T16:17:56.767Z",
  "pubdate": "2026-10-14T16:17:56.767Z",
  "executiveSummary": "The Dell Terraform Provider for Redfish, in versions prior to 1.6.2, is susceptible to a critical Improper Certificate Validation vulnerability within its HTTP transport mechanism.\nThis flaw arises because the provider unconditionally disables TLS certificate verification, effectively neutralizing the security guarantees of the TLS protocol.\nAn unauthenticated, remote attacker positioned as a Man-in-the-Middle (MitM) can intercept, inspect, and manipulate all Redfish Baseboard Management Controller (BMC) traffic, including sensitive administrative credentials and session tokens.\nThe vulnerability poses a severe risk to infrastructure integrity, as it enables unauthorized access to management interfaces and potential full control over managed hardware.\nSuccessful exploitation requires no prior authentication or specific privileges, as the attacker merely needs network access to intercept traffic between the Terraform client and the target BMC.\nDell has categorized this as a critical issue and mandates an immediate upgrade to version 1.6.2 or later to ensure secure communication.",
  "technicalDetails": "The root cause of this vulnerability is the programmatic implementation of the HTTP transport layer within the Dell Terraform Provider, which bypasses X.509 certificate chain validation.\nBy unconditionally disabling TLS verification, the transport client fails to verify the identity of the BMC endpoint, allowing any presented certificate—including self-signed or fraudulent ones—to be accepted as trusted.\nThis vulnerability manifests during the initial TLS handshake between the Terraform provider and the Redfish API. In a standard, secure implementation, the client would validate the server's certificate against a trusted Certificate Authority (CA) or verify the fingerprint of the remote device.\nIn the vulnerable versions, the client logic explicitly instructs the underlying Go 'crypto/tls' configuration (or equivalent transport wrapper) to bypass the 'VerifyPeerCertificate' or 'InsecureSkipVerify' flag, rendering the session vulnerable to interception.\nThe attack flow proceeds as follows: 1. An attacker establishes a Man-in-the-Middle position on the network segment between the Terraform host and the BMC. 2. The attacker uses tools like Ettercap or Bettercap to perform ARP spoofing or DNS redirection to intercept the traffic stream. 3. When the Terraform provider initiates a connection to the Redfish API, the attacker presents a malicious or intercepted certificate to the provider. 4. Due to the lack of validation, the provider silently trusts the attacker's certificate and completes the TLS handshake. 5. The attacker initiates an encrypted tunnel with both the client and the server, decrypting the traffic in transit.\nOnce the traffic is intercepted, the attacker can extract hardcoded credentials, session tokens, or sensitive configuration data transmitted within the HTTP headers or request bodies.\nPost-exploitation, the attacker can leverage the intercepted administrative credentials to perform unauthorized actions directly against the BMC, such as modifying hardware configurations, altering power states, accessing logs, or deploying malicious firmware updates. This bypasses all intended security controls provided by the Redfish protocol's encryption layer, effectively turning a secure management channel into an open plaintext stream for the attacker."
}