cyber.hendryadrian.com
Vulnerability & Exploit · wiz.io

OMIGOD Flaws Enable Root Access and Code Execution on Azure-Linked Linux Systems

· Original article ↗

Summary

Wiz disclosed four OMI flaws affecting Azure-linked and other Linux systems, including an unauthenticated remote-code-execution bug. Microsoft issued patches and began auto-updating some Azure deployments; other installations may need manual updates.

Key points

  • OMI is silently installed with several Azure services on Linux VMs and runs with root privileges.
  • The four disclosed flaws include CVE-2021-38647, an unauthenticated RCE, and three privilege-escalation vulnerabilities.
  • The RCE can provide root access when OMI's management ports are exposed; removing the Authorization header triggers the flaw.
  • Wiz estimated thousands of Azure customers and millions of endpoints could be affected; in its sample, over 65% of Azure tenants were at risk.
  • Wiz reported active exploitation attempts by Mirai DDoS botnets and cryptominers.
  • Microsoft released a fix; Azure service auto-updates were expected to complete by September 22, 2021, while some standalone and on-premises installations required manual updates.
  • The article advises verifying OMI version 1.6.8.1 and restricting access to ports 5985, 5986, and 1270.

Article Details

Vulnerability Types
  • Unauthenticated remote code execution
  • Privilege escalation
Severity
CVE-2021-38647: 9.8/10; the privilege-escalation vulnerabilities are rated 7.0–7.8.
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Limit network access to ports 5985, 5986, and 1270 when OMI is listening on them.

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationThree OMIGOD vulnerabilities allow attackers with low-privileged access to escalate to root on machines running OMI.T1190 · Exploit Public-Facing ApplicationCVE-2021-38647 allows unauthenticated remote code execution against OMI when its management port is externally accessible.

CVE

CVE-2021-38645CVE-2021-38645 – Privilege Escalation vulnerability (Severity: 7.8)CVE-2021-38647CVE-2021-38647 – Unauthenticated RCE as root (Severity: 9.8)CVE-2021-38648CVE-2021-38648 – Privilege Escalation vulnerability (Severity: 7.8)CVE-2021-38649CVE-2021-38649 – Privilege Escalation vulnerability (Severity: 7.0)

People

Sven SpiessCredited for bringing the impact on Azure Container Insights to Wiz's attention.Tom PlantCredited for bringing the impact on Azure Container Insights to Wiz's attention.

Malware

Miraithreat research team is aware of wide active exploitation attempts of OMIGOD by malicious DDoS botnets (Mirai) and cryptominers. We urge customers to follow the remediation steps below.

Vendors

MicrosoftUpdate September 18, 08:00AM EST - Microsoft updated its advisory and declared an auto-update for their PaaS service offerings that use vulnerable VM extensions by September 22, 2021. Microsoft also clarified which

Products

AzureUpdate September 17, 06:00AM EST - Microsoft has started updating impacted Azure services. Azure Log Analytics and others are yet to be patched. Existing machines onboarded to impacted services still require manualAzure Open Management Infrastructure (OMI)The source of the problem is a ubiquitous but little-known software agent called Open Management Infrastructure (OMI) that’s embedded in many popular Azure services.System Centerinstalled on any Linux machine and is frequently used on-premise. For example, OMI is built in System Center for Linux, Microsoft’s server management solution.

Industries

Cloud ComputingWiz’s research team recently discovered a series of alarming vulnerabilities that highlight the supply chain risk of open source code, particularly for customers of cloud computing services.

Related Articles