Clients of the Microsoft Azure cloud platform using Linux on virtual machines have encountered a critical vulnerability (CVE-2021-38647), allowing remote code execution with root privileges. The vulnerability is codenamed OMIGOD and is notable for being present in the OMI Agent application, which is installed quietly in Linux environments.
OMI Agent is automatically installed and activated when using services such as Azure Automation, Azure Automatic Update, Azure Operations Management Suite, Azure Log Analytics, Azure Configuration Management, Azure Diagnostics, and Azure Container Insights. For example, Azure Linux environments with monitoring enabled are vulnerable. The agent is part of the open-source OMI (Open Management Infrastructure Agent) package that implements the DMTF CIM/WBEM stack for IT infrastructure management.
OMI Agent is installed on the system under the omsagent user and creates settings in /etc/sudoers to run a series of scripts with root privileges. Some services create listening network sockets on network ports 5985, 5986, and 1270. Scanning on the Shodan service shows that there are more than 15,000 vulnerable Linux environments in the network. A working prototype of an exploit that allows executing one's own code with root privileges on such systems is already publicly available.
The problem is exacerbated by the fact that Azure does not explicitly document the use of OMI, and the OMI Agent is installed without warning — it's enough to agree to the terms of the chosen service when setting up the environment, and the OMI Agent will be automatically activated, meaning most users are unaware of its presence.
The exploitation method is trivial — simply send an XML request to the agent after removing the header responsible for authentication. OMI uses authentication when receiving management messages, verifying that the client has the right to send a particular command. The essence of the vulnerability lies in the removal of the 'Authentication' header in the message, which is responsible for authentication. server considers the verification process successful, accepts the control message, and permits the execution of commands with root privileges. To execute arbitrary commands in the system, it is enough to use the standard command ExecuteShellCommand_INPUT in the message. For example, to run the utility "id," simply send the request: curl -H "Content-Type: application/soap+xml;charset=UTF-8" -k --data-binary "@http_body.txt" https://10.0.0.5:5986/wsman …
id
0
Microsoft has already released the OMI 1.6.8.1 update to address the vulnerability, but it has not yet reached Microsoft Azure users (the old version of OMI is still being installed in new environments). The agent auto-update is not supported, so users need to manually update the package using the commands "dpkg -l omi" in Debian/Ubuntu or "rpm -qa omi" in Fedora/RHEL. As a workaround for security, it is recommended to block access to network ports 5985, 5986, and 1270.
In addition to CVE-2021-38647, OMI 1.6.8.1 has also addressed three vulnerabilities (CVE-2021-38648, CVE-2021-38645, and CVE-2021-38649) that allow an unprivileged local user to execute their code with root privileges.
Source: opennet.ru
