{"id":101307,"date":"2021-09-17T10:22:35","date_gmt":"2021-09-17T08:22:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure"},"modified":"2021-09-17T10:22:35","modified_gmt":"2021-09-17T08:22:35","slug":"udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","title":{"rendered":"Remote vulnerability in OMI Agent deployed in Microsoft Azure Linux environments","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Clients of the Microsoft Azure cloud platform using Linux on virtual machines have encountered a critical vulnerability (CVE-2021-38647), allowing remote code execution with root privileges. The vulnerability is codenamed OMIGOD and is notable for being present in the OMI Agent application, which is installed quietly in Linux environments. <\/p>\n
OMI Agent is automatically installed and activated when using services such as Azure Automation, Azure Automatic Update, Azure Operations Management Suite, Azure Log Analytics, Azure Configuration Management, Azure Diagnostics, and Azure Container Insights. For example, Azure Linux environments with monitoring enabled are vulnerable. The agent is part of the open-source OMI (Open Management Infrastructure Agent) package that implements the DMTF CIM\/WBEM stack for IT infrastructure management. <\/p>\n
OMI Agent is installed on the system under the omsagent user and creates settings in \/etc\/sudoers to run a series of scripts with root privileges. Some services create listening network sockets on network ports 5985, 5986, and 1270. Scanning on the Shodan service shows that there are more than 15,000 vulnerable Linux environments in the network. A working prototype of an exploit that allows executing one's own code with root privileges on such systems is already publicly available. <\/p>\n
The problem is exacerbated by the fact that Azure does not clearly document the use of OMI, and the OMI Agent is installed without warning \u2014 simply agreeing to the terms of the selected service during the environment setup automatically activates the OMI Agent, meaning most users are not even aware of its presence. <\/p>\n