OMIGOD vulnerabilities expose thousands of Azure users to hack
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-38647 | Unauthenticated RCE in Microsoft Open Management Infrastructure (OMI) CVE-2021-38647 is an unauthenticated remote code execution flaw (CWE-1390, missing authentication) in Microsoft's Open Management Infrastructure (OMI), the open-source Linux management agent Microsoft bundles into Azure VM management extensions and System Center Operations Manager (SCOM) agents. When OMI is deployed through these extensions (for example the Log Analytics/OMS agent, Azure Monitor, or Azure Automation), its root-privileged server component listens for management traffic on the network (by default ports 5985/5986), and an attacker who can reach that port can send specially crafted, unauthenticated management requests that execute commands as root. Successful exploitation gives an attacker full root-level control of the affected Linux VM, turning network reachability into complete host compromise and a foothold for lateral movement. Any Azure Linux VM with an OMI-based management extension, plus standalone OMI or SCOM-agent deployments on Linux, is affected; CISA added the bug to the KEV on 2021-11-03 with known ransomware use, so exploitation is confirmed in the wild even though no public proof-of-concept is catalogued, and EPSS estimates a ~99.9% near-term exploitation probability. Do: Upgrade OMI to version 1.6.8-1 or later on all Linux VMs, including updating the bundled OMI inside Azure management extensions (Log Analytics/OMS agent, Azure Monitor, Azure Automation) and applying patched SCOM agent builds. Restrict network access to OMI's listener ports (5985/5986) with NSGs or host firewalls and check whether omiserver runs as root while binding beyond localhost. Because the flaw is in CISA KEV with known ransomware use, prioritize patching hosts whose OMI listener is reachable from untrusted networks and hunt for unexplained root-level activity. | 9.8 group max | 100% | KEV ransomware PoC |
| mass≈ millions of Linux VMs with OMI-based Azure management extensions |
Full article450 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 15, 2021
OMIGOD – Microsoft addressed four vulnerabilities in the Open Management Infrastructure (OMI) software agent that could expose Azure users to attacks.
Recently released September 2021 Patch Tuesday security updates have addressed four severe vulnerabilities, collectively tracked as OMIGOD, in the Open Management Infrastructure (OMI) software agent that exposes Azure users to attack. Below is the list of the OMIGOD flaws:
- CVE-2021-38647 – Unauthenticated RCE as root (Severity: 9.8)
- CVE-2021-38648 – Privilege Escalation vulnerability (Severity: 7.8)
- CVE-2021-38645 – Privilege Escalation vulnerability (Severity: 7.8)
- CVE-2021-38649 – Privilege Escalation vulnerability (Severity: 7.0)
The vulnerabilities were reported by Wiz’s research team, an attacker could exploit OMIGOD vulnerabilities to execute code remotely or elevate privileges on vulnerable Linux virtual machines running on Azure.
Researchers estimate that thousands of Azure customers and millions of endpoints are potentially at risk of attack.
“When customers set up a Linux virtual machine in their cloud, the OMI agent is automatically deployed without their knowledge when they enable certain Azure services. Unless a patch is applied, attackers can easily exploit these four vulnerabilities to escalate to root privileges and remotely execute malicious code (for instance, encrypting files for ransom).” reads the analysis published by the experts. “We named this quartet of zero-days “OMIGOD” because that was our reaction when we discovered them. We conservatively estimate that thousands of Azure customers and millions of endpoints are affected. In a small sample of Azure tenants we analyzed, over 65% were unknowingly at risk.”
OMI is an open-source project written in C that allows users to manage configurations across environments, it is used in various Azure services, including Azure Automation, Azure Insights.
The most severe flaw is a remote code execution flaw tracked as CVE-2021-38647, it received a CVSS score of 9.8.
A remote, unauthenticated attacker could exploit the vulnerability by sending a specially crafted message via HTTPS to port listening to OMI on a vulnerable system.
“With a single packet, an attacker can become root on a remote machine by simply removing the authentication header. It’s that simple.” continues the analysis. “Thanks to the combination of a simple conditional statement coding mistake and an uninitialized auth struct, any request without an Authorization header has its privileges default to uid=0, gid=0, which is root. This vulnerability allows for remote takeover when OMI exposes the HTTPS management port externally (5986/5985/1270).”
Microsoft released a patched OMI version (1.6.8.1) and in order to mitigate the risk of attacks exploiting the CVE-2021-38647 RCE the IT giant recommends limiting network access to OMI listening on ports 5985, 5986, 1270.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, OMIGOD)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/122254/hacking/omigod-flaws.html