Experts warn that Mirai Botnet starts exploiting OMIGOD flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-38647 | Unauthenticated RCE in Microsoft Open Management Infrastructure (OMI) CVE-2021-38647 is an unauthenticated remote code execution flaw (CWE-1390, missing authentication) in Microsoft's Open Management Infrastructure (OMI), the open-source Linux management agent Microsoft bundles into Azure VM management extensions and System Center Operations Manager (SCOM) agents. When OMI is deployed through these extensions (for example the Log Analytics/OMS agent, Azure Monitor, or Azure Automation), its root-privileged server component listens for management traffic on the network (by default ports 5985/5986), and an attacker who can reach that port can send specially crafted, unauthenticated management requests that execute commands as root. Successful exploitation gives an attacker full root-level control of the affected Linux VM, turning network reachability into complete host compromise and a foothold for lateral movement. Any Azure Linux VM with an OMI-based management extension, plus standalone OMI or SCOM-agent deployments on Linux, is affected; CISA added the bug to the KEV on 2021-11-03 with known ransomware use, so exploitation is confirmed in the wild even though no public proof-of-concept is catalogued, and EPSS estimates a ~99.9% near-term exploitation probability. Do: Upgrade OMI to version 1.6.8-1 or later on all Linux VMs, including updating the bundled OMI inside Azure management extensions (Log Analytics/OMS agent, Azure Monitor, Azure Automation) and applying patched SCOM agent builds. Restrict network access to OMI's listener ports (5985/5986) with NSGs or host firewalls and check whether omiserver runs as root while binding beyond localhost. Because the flaw is in CISA KEV with known ransomware use, prioritize patching hosts whose OMI listener is reachable from untrusted networks and hunt for unexplained root-level activity. | 9.8 group max | 100% | KEV ransomware PoC |
| mass≈ millions of Linux VMs with OMI-based Azure management extensions |
Full article417 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 17, 2021
The Mirai botnet starts exploiting the recently disclosed OMIGOD vulnerability to compromise vulnerable systems exposed online.
Threat actors behind a Mirai botnet starts exploiting a critical Azure OMIGOD vulnerability, tracked as CVE-2021-38647, a few days after Microsoft disclosed them.
Recently released September 2021 Patch Tuesday security updates have addressed four severe vulnerabilities, collectively tracked as OMIGOD, in the Open Management Infrastructure (OMI) software agent that exposes Azure users to attack. Below is the list of the OMIGOD flaws:
- CVE-2021-38647 – Unauthenticated RCE as root (Severity: 9.8)
- CVE-2021-38648 – Privilege Escalation vulnerability (Severity: 7.8)
- CVE-2021-38645 – Privilege Escalation vulnerability (Severity: 7.8)
- CVE-2021-38649 – Privilege Escalation vulnerability (Severity: 7.0)
The vulnerabilities were reported by Wiz’s research team, an attacker could exploit OMIGOD vulnerabilities to execute code remotely or elevate privileges on vulnerable Linux virtual machines running on Azure.
Researchers estimate that thousands of Azure customers and millions of endpoints are potentially at risk of attack.
Threat actors immediately started scanning the Internet for vulnerable installs as confirmed by independent researchers and security firms. The popular expert Kevin Beaumont reported that a Mirai botnet is attempting to compromise vulnerable systems and that it also closes port 5896 (OMI SSL port) to prevent other threat actors to infect them.
https://twitter.com/GossiTheDog/status/1438832601221976065
— Andrew Morris (@Andrew___Morris) September 16, 2021The Azure "OHMIGOD" vulnerability (CVE-2021-38647) is increasing a good bit. ~10 IPs opportunistically exploiting the vuln across the internet this morning, ~80 now. Tags available to all GN users and customers now.
GNQL:
cve:CVE-2021-38647https://t.co/sbdxJxzrEd pic.twitter.com/7dyU213Pl1
Microsoft released a guidance that urges customers to update vulnerable extensions for their Cloud and On-Premises deployments as the updates become available per a schedule shared by the Microsoft Security Response Center team.
“New VMs in these regions will be protected from these vulnerabilities post the availability of updated extensions.” reads a Microsoft.
“Updates are already available for DSC and SCOM to address the remote execution vulnerability (RCE). While updates are being rolled out using safe deployment practices, customers can protect against the RCE vulnerability by ensuring VMs are deployed within a Network Security Group (NSG) or behind a perimeter firewall and restrict access to Linux systems that expose the OMI ports (TCP 5985, 5986, and 1270). Note that ports 5985 and 5986 are also used for PowerShell Remoting on Windows and are not impacted by these vulnerabilities. “
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Mirai)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/122322/hacking/omigod-mirai-botnet.html