Full Report
Wiz Research recently found 4 critical vulnerabilities in OMI, which is one of Azure's most ubiquitous yet least known software agents and is deployed on a large portion of Linux VMs in Azure.
Analysis Summary
# Vulnerability: OMIGOD - Critical RCE and Privilege Escalation in Azure OMI Agent
## CVE Details
- CVE ID: CVE-2021-38647, CVE-2021-38648, CVE-2021-38645, CVE-2021-38649
- CVSS Score: Not explicitly provided, but described as "critical" and RCE achieving root access.
- CWE: Specific CWEs not detailed, but likely related to Authentication Bypass and Improper Access Control.
## Affected Systems
- Products: Azure OMI (Open Management Infrastructure) Agent, used in various Azure services including Azure Log Analytics, Azure Diagnostics, and Azure Security Center.
- Versions: All versions running OMI on affected Linux VMs in Azure where the agent is deployed. (Users are advised to check vendor guidance for specific patched versions).
- Configurations: CVE-2021-38647 (RCE) is most severe when OMI exposes the HTTPS management ports (5986/5985/1270) externally, which is default in standalone installations and Azure Configuration Management/SCOM setups. The other three are Privilege Escalation vulnerabilities.
## Vulnerability Description
The Open Management Infrastructure (OMI) agent runs with root privileges on targeted Azure Linux VMs and is used extensively by Microsoft management services. Four critical vulnerabilities exist:
1. **CVE-2021-38647 (RCE):** A textbook, unauthenticated Remote Code Execution vulnerability. A coding mistake involving an uninitialized authentication struct causes the OMI server to default privileges to `uid=0`, `gid=0` (root) if an HTTP request is sent *without* an `Authorization` header. This allows an attacker to execute arbitrary code as root with a single manipulated network request if the management port is exposed.
2. **CVE-2021-38648, CVE-2021-38645, CVE-2021-38649 (Privilege Escalation):** These vulnerabilities allow attackers who already have low-level access to escalate their privileges to root on the host machine.
## Exploitation
- Status: Proof-of-Concept (PoC) is available, and the vulnerabilities are described as "very easy to exploit," potentially allowing attackers to gain initial access via RCE (where applicable) and spread laterally.
- Complexity: Low (for RCE via unauthenticated request) to Medium/Statistical (for the complex race condition described in the full technical detail, though the end result is RCE).
- Attack Vector: Network (for RCE if ports are exposed); Local (for Privilege Escalation).
## Impact
- Confidentiality: High (Root access allows access to all system data).
- Integrity: High (Root access allows modification or destruction of system files/data).
- Availability: High (Root access allows for service disruption or system shutdown).
## Remediation
### Patches
The advisory mentions Microsoft addressing the flaws, but specific patched versions are not detailed in this summary. Users must consult the official Microsoft Security Response Center (MSRC) guidance for OMI agent updates.
### Workarounds
- The primary mitigation is ensuring that OMI management ports (5986, 5985, 1270) are **not** exposed to the internet and are restricted to trusted networks or local access only.
- Since the OMI agent is often deployed silently by Azure services, internal network protection is crucial while waiting for confirmed patch deployments.
## Detection
- Indicators of Compromise: Observing an elevated number of incoming requests to OMI management ports lacking the `Authorization` header, or unexpected process execution originating from the OMI daemon/user.
- Detection Methods and Tools: Organizations should use security scanning tools to identify OMI installations and potentially develop network monitoring rules targeting malformed header requests to OMI endpoints.
## References
- Vendor Advisories: Microsoft Security Response Center (MSRC) guidance for CVE-2021-38647 through CVE-2021-38649.
- Relevant Links:
- High-level overview and mitigation updates: `blog.wiz.io/secret-agent-exposes-azure-customers-to-unauthorized-code-execution` (Defanged: hxxps://blog.wiz.io/secret-agent-exposes-azure-customers-to-unauthorized-code-execution)
- Remediation checklist: `wiz.io/lp/omigod-checklist` (Defanged: hxxps://www.wiz.io/lp/omigod-checklist)