OMIGOD
- Product
- Microsoft Open Management Infrastructure (OMI) on Azure Linux VMs
- CVE
- CVE-2021-38647CVE-2021-38645CVE-2021-38648CVE-2021-38649
- Disclosed
- 2021-09-14
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- OMI before 1.6.8-1 (silently installed by Azure extensions such as Log Analytics, Automation, Diagnostics)
- Fixed
- OMI 1.6.8-1
Summary
Wiz found that OMI, an agent Azure quietly installed on many Linux VMs, ran as root and treated requests with no Authorization header as coming from root. Where OMI's ports were exposed, a single unauthenticated request ran commands as root, and it was exploited by Mirai-style botnets within days.
Root cause
OMI's authentication logic initialized the caller's uid/gid to 0 and only overwrote them after successful authentication. When the Authorization header was omitted entirely, the request continued with root identity. The ExecuteShellCommand method of the SCX_OperatingSystem provider then ran the supplied command as root.
Impact
Unauthenticated remote root on Linux VMs with OMI listening on 5985/5986/1270; the other three CVEs were local privilege escalations.
Detection
Check the omi package version (dpkg -l omi / rpm -q omi); scan for 5985/5986/1270 listeners on Linux; look for WS-Man POSTs to /wsman without Authorization headers. Nuclei template CVE-2021-38647.
Mitigation
Update OMI to 1.6.8-1+ (extensions do not always auto-update) and block OMI ports from the internet.