{"id":101307,"date":"2021-09-17T10:22:35","date_gmt":"2021-09-17T08:22:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure"},"modified":"2021-09-17T10:22:35","modified_gmt":"2021-09-17T08:22:35","slug":"udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","title":{"rendered":"Zdalnie eksploatowana luka w agencie OMI, narzucanym w \u015brodowiskach Linux Microsoft Azure","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Klienci chmurowej platformy Microsoft Azure, korzystaj\u0105cy z systemu Linux na maszynach wirtualnych, napotkali krytyczn\u0105 luk\u0119 (CVE-2021-38647), umo\u017cliwiaj\u0105c\u0105 zdalne wykonywanie kodu z uprawnieniami roota. Luka otrzyma\u0142a kodow\u0105 nazw\u0119 OMIGOD i jest szczeg\u00f3lnie istotna, poniewa\u017c problem wyst\u0119puje w aplikacji OMI Agent, kt\u00f3ra bez \u017cadnych zapowiedzi jest instalowana w \u015brodowiskach Linux. <\/p>\n

OMI Agent automatycznie instaluje si\u0119 i aktywuje przy korzystaniu z us\u0142ug takich jak Azure Automation, Azure Automatic Update, Azure Operations Management Suite, Azure Log Analytics, Azure Configuration Management, Azure Diagnostics i Azure Container Insights. Na przyk\u0142ad, atakuj\u0105cy mog\u0105 zyska\u0107 dost\u0119p do \u015brodowisk Linux w Azure, dla kt\u00f3rych w\u0142\u0105czono monitoring. Agent jest cz\u0119\u015bci\u0105 otwartego pakietu OMI (Open Management Infrastructure Agent) realizuj\u0105cego stos DMTF CIM\/WBEM do zarz\u0105dzania infrastruktur\u0105 IT. <\/p>\n

OMI Agent jest instalowany w systemie jako u\u017cytkownik omsagent i tworzy konfiguracje w \/etc\/sudoers do uruchamiania serii skrypt\u00f3w z uprawnieniami roota. W trakcie dzia\u0142ania niekt\u00f3rych us\u0142ug tworzone s\u0105 nas\u0142uchuj\u0105ce gniazda sieciowe na portach 5985, 5986 i 1270. Skanowanie w serwisie Shodan pokazuje obecno\u015b\u0107 w sieci ponad 15 tysi\u0119cy podatnych \u015brodowisk Linux. Obecnie w sieci dost\u0119pny jest ju\u017c dzia\u0142aj\u0105cy prototyp exploita, umo\u017cliwiaj\u0105cy wykonanie w\u0142asnego kodu z uprawnieniami roota w podobnych systemach. <\/p>\n

Problem jest jeszcze powa\u017cniejszy, poniewa\u017c w Azure zastosowanie OMI nie jest wyra\u017anie udokumentowane, a OMI Agent jest instalowany bez ostrze\u017cenia \u2014 wystarczy zgodzi\u0107 si\u0119 na warunki wybranego serwisu podczas konfigurowania \u015brodowiska, a OMI Agent zostanie automatycznie aktywowany, co oznacza, \u017ce wi\u0119kszo\u015b\u0107 u\u017cytkownik\u00f3w nawet nie podejrzewa o jego istnieniu. <\/p>\n

Metoda eksploatacji jest trywialna \u2014 wystarczy wys\u0142a\u0107 do agenta zapytanie XML, usuwaj\u0105c nag\u0142\u00f3wek odpowiedzialny za uwierzytelnienie. OMI korzysta z uwierzytelnienia podczas odbierania komunikat\u00f3w steruj\u0105cych, sprawdzaj\u0105c, czy klient ma prawo do wys\u0142ania danej komendy. Istota podatno\u015bci polega na tym, \u017ce po usuni\u0119ciu w komunikacie nag\u0142\u00f3wka \u201eAuthentication\u201d, odpowiedzialnego za uwierzytelnienie, serwer<\/a> uznaje przej\u015bcie sprawdzania za udane, przyjmuje komunikat steruj\u0105cy i pozwala na wykonywanie polece\u0144 z uprawnieniami root. Aby wykona\u0107 dowolne polecenia w systemie, wystarczy u\u017cy\u0107 w komunikacie standardowej komendy ExecuteShellCommand_INPUT. Na przyk\u0142ad, aby uruchomi\u0107 narz\u0119dzie \u201eid\u201d, wystarczy wys\u0142a\u0107 zapytanie: curl -H \u201eContent-Type: application\/soap+xml;charset=UTF-8\u201d -k \u2014data-binary \u201e@http_body.txt\u201d https:\/\/10.0.0.5:5986\/wsman \u2026

id<\/p>

0<\/p> <\/p> <\/s> <\/s> <\/p>\n

Firma Microsoft ju\u017c wyda\u0142a aktualizacj\u0119 OMI 1.6.8.1 z eliminacj\u0105 podatno\u015bci, ale jeszcze nie dotar\u0142a ona do u\u017cytkownik\u00f3w Microsoft Azure (w nowych \u015brodowiskach wci\u0105\u017c instalowana jest stara wersja OMI). Automatyczne aktualizacje agenta nie s\u0105 wspierane, dlatego u\u017cytkownicy musz\u0105 zaktualizowa\u0107 pakiet r\u0119cznie, u\u017cywaj\u0105c komend \u201edpkg -l omi\u201d w Debianie\/Ubuntu lub \u201erpm -qa omi\u201d w Fedora\/RHEL. Jako obej\u015bcie ochrony zaleca si\u0119 zablokowanie dost\u0119pu do port\u00f3w sieciowych 5985, 5986 i 1270. <\/p>\n

Opr\u00f3cz CVE-2021-38647 w OMI 1.6.8.1 usuni\u0119to r\u00f3wnie\u017c trzy luki (CVE-2021-38648, CVE-2021-38645 i CVE-2021-38649), kt\u00f3re pozwalaj\u0105 nieuprzywilejowanemu lokalnemu u\u017cytkownikowi na wykonanie swojego kodu z uprawnieniami root.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043b\u0438\u0435\u043d\u0442\u044b \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Microsoft Azure, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 Linux \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e (CVE-2021-38647), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f OMIGOD \u0438 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 OMI Agent, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0431\u0435\u0437 \u043b\u0438\u0448\u043d\u0435\u0439 \u043e\u0433\u043b\u0430\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. OMI Agent \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0442\u0430\u043a\u0438\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, \u043a\u0430\u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101307","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zdalnie wykorzystywana luka w agencie OMI, narzuconym w \u015brodowiskach Linux Microsoft Azure | ProHoster","description":"Klienci chmurowej platformy Microsoft Azure, korzystaj\u0105cy z systemu Linux na maszynach wirtualnych, napotkali krytyczn\u0105 luk\u0119 (CVE-2021-38647), kt\u00f3ra pozwala na zdalne wykonanie kodu z uprawnieniami root.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OMI-\u0430\u0433\u0435\u043d\u0442\u0435, \u043d\u0430\u0432\u044f\u0437\u044b\u0432\u0430\u0435\u043c\u043e\u043c \u0432 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 Microsoft Azure | ProHoster","og:description":"\u041a\u043b\u0438\u0435\u043d\u0442\u044b \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Microsoft Azure, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 Linux \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e (CVE-2021-38647), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-17T08:22:35+00:00","article:modified_time":"2021-09-17T08:22:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101307","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-17 08:49:36","updated":"2022-10-07 00:05:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/101307","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=101307"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/101307\/revisions"}],"predecessor-version":[{"id":172940,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/101307\/revisions\/172940"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=101307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=101307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=101307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}