cyber.hendryadrian.com
Threat Research · wiz.io

OMIGOD: Four OMI Flaws Expose Azure Linux VMs to Root Compromise

· Original article ↗

Summary

Wiz detailed four OMI vulnerabilities affecting Azure Linux VMs, including unauthenticated remote root execution and local privilege escalation. Its research explains authentication failures and notes fixes in OMI 1.6.8-1.

Key points

  • Wiz identified CVE-2021-38647, an unauthenticated remote code execution flaw, and three local privilege escalation flaws: CVE-2021-38648, CVE-2021-38645 and CVE-2021-38649.
  • CVE-2021-38647 lets requests without an Authorization header bypass authentication; zero-initialized user and group IDs cause commands to execute as root.
  • Remote exploitation requires reachable OMI management ports, including 5986, 5985 or 1270. Most Azure services using OMI do not expose these ports.
  • CVE-2021-38648 allows local users to skip the authentication handshake because the frontend forwards certain requests with default root identity information.
  • CVE-2021-38645 permits forged authentication responses through missing server validation; successful exploitation requires winning a race condition.
  • Wiz reported exposure among over 65% of sampled Azure customers and highlighted limited visibility into OMI agents deployed by Azure management services.
  • Microsoft released OMI 1.6.8-1 on September 8, 2021. Wiz warned that a public security-fix commit had revealed the flaws on August 12, before the official release.

Article Details

Attack Vectors
  • An unauthenticated HTTP command-execution request without an Authorization header is accepted with uid=0 and gid=0 when the vulnerable management interface is reachable on ports 5986, 5985, or 1270.
  • A local low-privileged user can send a command-execution message through /var/opt/omi/run/omiserver.sock without completing authentication. The frontend forwards the request with default root identity metadata.
  • A malicious local client can impersonate a server authentication response, guess a client socket identifier, and race the legitimate response to assign root identity metadata. Wiz demonstrated this using a multithreaded Python script; exploitation was statistical and could crash the frontend.
Defensive Notes
  • Wiz urges affected customers to update the agent. The official patch, version 1.6.8-1, was released on 2021-09-08.
  • Assess installed agents even when no management port is exposed: the article distinguishes remotely reachable deployments from installations that remain exposed to local privilege escalation.
  • Inventory preinstalled, high-privilege agents on cloud VMs. Wiz reports that undocumented deployment and lack of visibility in the cloud portal impaired customers' ability to identify affected machines.
  • Wiz observed a public security-fix commit on 2021-08-12, before the official release. The article raises potential exploitation risk from patch comparison but does not establish that exploitation occurred.

MITRE ATT&CK

T1059.004 · Unix ShellThe demonstrations invoke ExecuteShellCommand with id, and the local race-condition exploit sends id >> /tmp/win to demonstrate root command execution.T1068 · Exploitation for Privilege EscalationWiz demonstrates local escalation to root through OMI authentication bypass and forged authentication responses over its UNIX socket.T1190 · Exploit Public-Facing ApplicationThe research demonstrates unauthenticated root command execution by omitting the Authorization header from requests to an exposed OMI management interface; internet-accessible deployments could provide initial access.

CVE

CVE-2021-38645CVE-2021-38645 – Privilege Escalation vulnerabilityCVE-2021-38647CVE-2021-38647 – Unauthenticated RCE as rootCVE-2021-38648CVE-2021-38648 – Privilege Escalation vulnerabilityCVE-2021-38649CVE-2021-38649 – Privilege Escalation vulnerability

Vendors

Microsoftin Azure are affected, including Azure Log Analytics, Azure Diagnostics and Azure Security Center, as Microsoft uses OMI extensively behind the scenes as a common component for many of its management services for

Products

AzureThe Wiz Research Team recently found four critical vulnerabilities in OMI, which is one of Azure's most ubiquitous yet least known software agents and is deployed on a large portion of Linux VMs in Azure. TheAzure Configuration Management(5986/5985/1270). This is in fact the default configuration when installed standalone and in Azure Configuration Management or System Center Operations Manager (SCOM). Fortunately, other Azure services (such as LogAzure DiagnosticsMany different services in Azure are affected, including Azure Log Analytics, Azure Diagnostics and Azure Security Center, as Microsoft uses OMI extensively behind the scenes as a common component for many of itsAzure Log AnalyticsMany different services in Azure are affected, including Azure Log Analytics, Azure Diagnostics and Azure Security Center, as Microsoft uses OMI extensively behind the scenes as a common component for many of itsAzure Open Management Infrastructure (OMI)The Wiz Research Team recently found four critical vulnerabilities in OMI, which is one of Azure's most ubiquitous yet least known software agents and is deployed on a large portion of Linux VMs in Azure. TheAzure Security Centerdifferent services in Azure are affected, including Azure Log Analytics, Azure Diagnostics and Azure Security Center, as Microsoft uses OMI extensively behind the scenes as a common component for many of itsSystem Center Operations Managerdefault configuration when installed standalone and in Azure Configuration Management or System Center Operations Manager (SCOM). Fortunately, other Azure services (such as Log Analytics) do not expose this port and

Tools

Burp Suitewhich will be executed with the user’s privileges, provided the correct password is supplied. By using Burp Suite and examining the traffic, we can see the protocol is very basic:

Related Articles