{"id":101307,"date":"2021-09-17T10:22:35","date_gmt":"2021-09-17T08:22:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure"},"modified":"2021-09-17T10:22:35","modified_gmt":"2021-09-17T08:22:35","slug":"udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","title":{"rendered":"Vzd\u00e1len\u011b zneu\u017eiteln\u00e1 zranitelnost v OMI agentu, kter\u00fd je vynucovan\u00fd v Linuxov\u00fdch prost\u0159ed\u00edch Microsoft Azure","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Klienti cloudov\u00e9 platformy Microsoft Azure, kte\u0159\u00ed pou\u017e\u00edvaj\u00ed Linux ve virtu\u00e1ln\u00edch stroj\u00edch, se setkali s kritickou zranitelnost\u00ed (CVE-2021-38647), kter\u00e1 umo\u017e\u0148uje vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed k\u00f3du s pr\u00e1vy roota. Zranitelnost byla ozna\u010dena jako OMIGOD a je v\u00fdznamn\u00e1 t\u00edm, \u017ee probl\u00e9m existuje v aplikaci OMI Agent, kter\u00e1 je bez okolk\u016f instalov\u00e1na do linuxov\u00fdch prost\u0159ed\u00ed. <\/p>\n

OMI Agent se automaticky instaluje a aktivuje p\u0159i pou\u017eit\u00ed takov\u00fdch slu\u017eeb, jako jsou Azure Automation, Azure Automatic Update, Azure Operations Management Suite, Azure Log Analytics, Azure Configuration Management, Azure Diagnostics a Azure Container Insights. Nap\u0159\u00edklad jsou ohro\u017eena linuxov\u00e1 prost\u0159ed\u00ed v Azure, pro kter\u00e1 je povoleno monitorov\u00e1n\u00ed. Agent je sou\u010d\u00e1st\u00ed otev\u0159en\u00e9ho bal\u00ed\u010dku OMI (Open Management Infrastructure Agent) s implementac\u00ed z\u00e1sobn\u00edku DMTF CIM\/WBEM pro spr\u00e1vu IT infrastruktury. <\/p>\n

OMI Agent se instaluje do syst\u00e9mu pod u\u017eivatelsk\u00fdm jm\u00e9nem omsagent a vytv\u00e1\u0159\u00ed nastaven\u00ed v \/etc\/sudoers pro spu\u0161t\u011bn\u00ed s\u00e9rie skript\u016f s pr\u00e1vy roota. V pr\u016fb\u011bhu pr\u00e1ce n\u011bkter\u00fdch slu\u017eeb se vytv\u00e1\u0159ej\u00ed s\u00ed\u0165ov\u00e9 sockety naslouchaj\u00edc\u00ed na s\u00ed\u0165ov\u00fdch portech 5985, 5986 a 1270. Skener Shodan ukazuje, \u017ee v s\u00edti je v\u00edce ne\u017e 15 tis\u00edc zraniteln\u00fdch linuxov\u00fdch prost\u0159ed\u00ed. V sou\u010dasnosti je ji\u017e ve\u0159ejn\u011b dostupn\u00fd pracovn\u00ed prototyp exploit, kter\u00fd umo\u017e\u0148uje spustit vlastn\u00ed k\u00f3d s pr\u00e1vy roota na podobn\u00fdch syst\u00e9mech. <\/p>\n

Probl\u00e9m se zhor\u0161uje t\u00edm, \u017ee v Azure nen\u00ed jasn\u011b zdokumentov\u00e1no pou\u017eit\u00ed OMI a OMI Agent se instaluje bez upozorn\u011bn\u00ed \u2014 sta\u010d\u00ed souhlasit s podm\u00ednkami vybran\u00e9ho slu\u017eby p\u0159i nastavov\u00e1n\u00ed prost\u0159ed\u00ed a OMI Agent bude automaticky aktivov\u00e1n, tj. v\u011bt\u0161ina u\u017eivatel\u016f ani netu\u0161\u00ed o jeho p\u0159\u00edtomnosti. <\/p>\n

Metoda zneu\u017eit\u00ed je trivi\u00e1ln\u00ed \u2014 sta\u010d\u00ed poslat k agentu XML po\u017eadavek, p\u0159i \u010dem\u017e je t\u0159eba odstranit hlavi\u010dku zaji\u0161\u0165uj\u00edc\u00ed autentizaci. OMI pou\u017e\u00edv\u00e1 autentizaci p\u0159i p\u0159ij\u00edm\u00e1n\u00ed \u0159\u00eddic\u00edch zpr\u00e1v, \u010d\u00edm\u017e kontroluje, zda m\u00e1 klient pr\u00e1vo na odesl\u00e1n\u00ed konkr\u00e9tn\u00edho p\u0159\u00edkazu. Podstatou zranitelnosti je to, \u017ee p\u0159i odstran\u011bn\u00ed hlavi\u010dky \"Authentication\", zaji\u0161\u0165uj\u00edc\u00ed autentizaci, server<\/a> pova\u017euje proveden\u00ed kontroly za \u00fasp\u011b\u0161n\u00e9, p\u0159ij\u00edm\u00e1 \u0159\u00eddic\u00ed zpr\u00e1vu a umo\u017e\u0148uje prov\u00e1d\u011bn\u00ed p\u0159\u00edkaz\u016f s pr\u00e1vy root. Pro prov\u00e1d\u011bn\u00ed libovoln\u00fdch p\u0159\u00edkaz\u016f v syst\u00e9mu sta\u010d\u00ed v zpr\u00e1v\u011b pou\u017e\u00edt standardn\u00ed p\u0159\u00edkaz ExecuteShellCommand_INPUT. Nap\u0159\u00edklad pro spu\u0161t\u011bn\u00ed utility \"id\" sta\u010d\u00ed poslat po\u017eadavek: curl -H \"Content-Type: application\/soap+xml;charset=UTF-8\" -k --data-binary \"@http_body.txt\" https:\/\/10.0.0.5:5986\/wsman ...

id<\/p>

0<\/p> <\/p> <\/s> <\/s> <\/p>\n

Spole\u010dnost Microsoft ji\u017e vydala aktualizaci OMI 1.6.8.1, kter\u00e1 odstra\u0148uje zranitelnost, ale dosud nebyla zp\u0159\u00edstupn\u011bna u\u017eivatel\u016fm Microsoft Azure (v nov\u00fdch prost\u0159ed\u00edch se zat\u00edm instaluje star\u00e1 verze OMI). Automatick\u00e9 aktualizace agenta nejsou podporov\u00e1ny, a proto je nutn\u00e9 prov\u00e9st aktualizaci bal\u00ed\u010dku ru\u010dn\u011b pomoc\u00ed p\u0159\u00edkaz\u016f \"dpkg -l omi\" v Debian\/Ubuntu nebo \"rpm -qa omi\" v Fedora\/RHEL. Jako obchvat pro ochranu se doporu\u010duje zablokovat p\u0159\u00edstup k s\u00ed\u0165ov\u00fdm port\u016fm 5985, 5986 a 1270. <\/p>\n

Krom\u011b CVE-2021-38647 byla v OMI 1.6.8.1 tak\u00e9 odstran\u011bna t\u0159i zranitelnosti (CVE-2021-38648, CVE-2021-38645 a CVE-2021-38649), kter\u00e9 umo\u017e\u0148uj\u00ed nezprivilegovan\u00e9mu m\u00edstn\u00edmu u\u017eivateli spou\u0161t\u011bt sv\u016fj k\u00f3d s pr\u00e1vy root.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043b\u0438\u0435\u043d\u0442\u044b \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Microsoft Azure, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 Linux \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e (CVE-2021-38647), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f OMIGOD \u0438 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 OMI Agent, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0431\u0435\u0437 \u043b\u0438\u0448\u043d\u0435\u0439 \u043e\u0433\u043b\u0430\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. OMI Agent \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0442\u0430\u043a\u0438\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, \u043a\u0430\u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101307","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vzd\u00e1len\u011b zneu\u017eiteln\u00e1 zranitelnost v agentu OMI, vynucen\u00e9m v linuxov\u00fdch prost\u0159ed\u00edch Microsoft Azure | ProHoster","description":"Z\u00e1kazn\u00edci cloudov\u00e9 platformy Microsoft Azure, kte\u0159\u00ed pou\u017e\u00edvaj\u00ed Linux na virtu\u00e1ln\u00edch stroj\u00edch, se setkali s kritickou zranitelnost\u00ed (CVE-2021-38647), kter\u00e1 umo\u017e\u0148uje vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed k\u00f3du s pr\u00e1vy root.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OMI-\u0430\u0433\u0435\u043d\u0442\u0435, \u043d\u0430\u0432\u044f\u0437\u044b\u0432\u0430\u0435\u043c\u043e\u043c \u0432 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 Microsoft Azure | ProHoster","og:description":"\u041a\u043b\u0438\u0435\u043d\u0442\u044b \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Microsoft Azure, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 Linux \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e (CVE-2021-38647), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-17T08:22:35+00:00","article:modified_time":"2021-09-17T08:22:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101307","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-17 08:49:36","updated":"2022-10-07 00:05:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101307","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=101307"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101307\/revisions"}],"predecessor-version":[{"id":172940,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101307\/revisions\/172940"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=101307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=101307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=101307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}