{"id":101307,"date":"2021-09-17T10:22:35","date_gmt":"2021-09-17T08:22:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure"},"modified":"2021-09-17T10:22:35","modified_gmt":"2021-09-17T08:22:35","slug":"udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","title":{"rendered":"Vzdialene zneu\u017e\u00edvan\u00e1 zranite\u013enos\u0165 v OMI agentovi, ktor\u00fd je nain\u0161talovan\u00fd v Linuxov\u00fdch prostrediach Microsoft Azure","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Klienti cloudovej platformy Microsoft Azure, ktor\u00ed pou\u017e\u00edvaj\u00fa Linux vo virtu\u00e1lnych strojoch, \u010delili kritickej zranite\u013enosti (CVE-2021-38647), ktor\u00e1 umo\u017e\u0148uje vzdialen\u00e9 vykonanie k\u00f3du s pr\u00e1vami root. Zranite\u013enos\u0165 dostala k\u00f3dov\u00e9 meno OMIGOD a je pozoruhodn\u00e1 t\u00fdm, \u017ee probl\u00e9m existuje v aplik\u00e1cii OMI Agent, ktor\u00e1 sa bez zbyto\u010dn\u00e9ho rozruchu in\u0161taluje do linuxov\u00fdch prostred\u00ed. <\/p>\n

OMI Agent sa automaticky in\u0161taluje a aktivuje pri pou\u017e\u00edvan\u00ed tak\u00fdch slu\u017eieb, ako s\u00fa Azure Automation, Azure Automatic Update, Azure Operations Management Suite, Azure Log Analytics, Azure Configuration Management, Azure Diagnostics a Azure Container Insights. Napr\u00edklad, na \u00fatoky s\u00fa n\u00e1chyln\u00e9 linuxov\u00e9 prostredia v Azure, pre ktor\u00e9 je povolen\u00e9 monitorovanie. Agent je s\u00fa\u010das\u0165ou otvoren\u00e9ho bal\u00edka OMI (Open Management Infrastructure Agent) s implement\u00e1ciou z\u00e1sobn\u00edka DMTF CIM\/WBEM na spr\u00e1vu IT infra\u0161trukt\u00fary. <\/p>\n

OMI Agent sa in\u0161taluje do syst\u00e9mu pod pou\u017e\u00edvate\u013eom omsagent a vytv\u00e1ra nastavenia v \/etc\/sudoers na sp\u00fa\u0161\u0165anie s\u00e9rie skriptov s pr\u00e1vami root. V procese \u010dinnosti niektor\u00fdch slu\u017eieb sa vytv\u00e1raj\u00fa posluchov\u00e9 sie\u0165ov\u00e9 z\u00e1suvky na sie\u0165ov\u00fdch portoch 5985, 5986 a 1270. Skenovanie v slu\u017ebe Shodan ukazuje pr\u00edtomnos\u0165 viac ako 15 000 zranite\u013en\u00fdch linuxov\u00fdch prostred\u00ed. V s\u00fa\u010dasnosti je u\u017e vo verejnom pr\u00edstupe umiestnen\u00fd funk\u010dn\u00fd prototyp exploitu, ktor\u00fd umo\u017e\u0148uje vykona\u0165 svoj k\u00f3d s pr\u00e1vami root na podobn\u00fdch syst\u00e9moch. <\/p>\n

Probl\u00e9m je umocnen\u00fd t\u00fdm, \u017ee v Azure nie je jasne zdokumentovan\u00e9 pou\u017eitie OMI a OMI Agent sa in\u0161taluje bez varovania \u2014 sta\u010d\u00ed s\u00fahlasi\u0165 s podmienkami zvolen\u00e9ho servisu pri nastaven\u00ed prostredia a OMI Agent bude automaticky aktivovan\u00fd, t. j. v\u00e4\u010d\u0161ina pou\u017e\u00edvate\u013eov ani netu\u0161\u00ed o jeho existencii. <\/p>\n

Met\u00f3da zneu\u017eitia je trivi\u00e1lna \u2014 sta\u010d\u00ed posla\u0165 agentovi XML-\u017eiados\u0165, pri\u010dom odstr\u00e1nite hlavi\u010dku zodpovedaj\u00facu za autentifik\u00e1ciu. OMI pou\u017e\u00edva autentifik\u00e1ciu pri prij\u00edman\u00ed riadiacich spr\u00e1v, overuj\u00fac, \u017ee klient m\u00e1 pr\u00e1vo posla\u0165 dan\u00fd pr\u00edkaz. Podstatou zranite\u013enosti je, \u017ee pri odstr\u00e1nen\u00ed hlavi\u010dky \u201eAuthentication\u201c, zodpovedaj\u00facej za autentifik\u00e1ciu, server<\/a> pova\u017euje prechod overen\u00edm za \u00faspe\u0161n\u00fd, prij\u00edma riadiacu spr\u00e1vu a dovo\u013euje vykon\u00e1vanie pr\u00edkazov s pr\u00e1vami root. Na vykon\u00e1vanie \u013eubovo\u013en\u00fdch pr\u00edkazov v syst\u00e9me sta\u010d\u00ed pou\u017ei\u0165 v spr\u00e1ve \u0161tandardn\u00fd pr\u00edkaz ExecuteShellCommand_INPUT. Napr\u00edklad na spustenie n\u00e1stroja \u201eid\u201c sta\u010d\u00ed posla\u0165 \u017eiados\u0165: curl -H \u201eContent-Type: application\/soap+xml;charset=UTF-8\u201c -k \u2014data-binary \u201e@http_body.txt\u201c https:\/\/10.0.0.5:5986\/wsman \u2026

id<\/p>

0<\/p> <\/p> <\/s> <\/s> <\/p>\n

Spolo\u010dnos\u0165 Microsoft u\u017e vydala aktualiz\u00e1ciu OMI 1.6.8.1 na odstr\u00e1nenie zranite\u013enosti, ale t\u00e1 e\u0161te nie je distribuovan\u00e1 pou\u017e\u00edvate\u013eom Microsoft Azure (v nov\u00fdch prostrediach sa zatia\u013e in\u0161taluje star\u00e1 verzia OMI). Automatick\u00e9 aktualiz\u00e1cie agenta nie s\u00fa podporovan\u00e9, tak\u017ee pou\u017e\u00edvate\u013eom je potrebn\u00e9 vykona\u0165 aktualiz\u00e1ciu bal\u00edka ru\u010dne, pomocou pr\u00edkazov \u201edpkg -l omi\u201c v Debian\/Ubuntu alebo \u201erpm -qa omi\u201c v Fedora\/RHEL. Ako obch\u00e1dzaj\u00facu ochranu sa odpor\u00fa\u010da blokova\u0165 pr\u00edstup na sie\u0165ov\u00e9 porty 5985, 5986 a 1270. <\/p>\n

Okrem CVE-2021-38647 v OMI 1.6.8.1 boli odstr\u00e1nen\u00e9 aj tri zranite\u013enosti (CVE-2021-38648, CVE-2021-38645 a CVE-2021-38649), ktor\u00e9 umo\u017e\u0148uj\u00fa neprivilegovan\u00e9mu lok\u00e1lnemu pou\u017e\u00edvate\u013eovi vykona\u0165 svoj k\u00f3d s pr\u00e1vami root.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043b\u0438\u0435\u043d\u0442\u044b \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Microsoft Azure, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 Linux \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e (CVE-2021-38647), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f OMIGOD \u0438 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 OMI Agent, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0431\u0435\u0437 \u043b\u0438\u0448\u043d\u0435\u0439 \u043e\u0433\u043b\u0430\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. OMI Agent \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0442\u0430\u043a\u0438\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, \u043a\u0430\u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101307","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vzdialene zneu\u017eite\u013en\u00e1 zranite\u013enos\u0165 v OMI agente, zav\u00e1dzanom v Linuxov\u00fdch prostrediach Microsoft Azure | ProHoster","description":"Klienti cloudovej platformy Microsoft Azure, ktor\u00ed pou\u017e\u00edvaj\u00fa Linux na virtu\u00e1lnych strojoch, \u010delili kritickej zranite\u013enosti (CVE-2021-38647), ktor\u00e1 umo\u017e\u0148uje vzdialene spusti\u0165 k\u00f3d s pr\u00e1vami root.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OMI-\u0430\u0433\u0435\u043d\u0442\u0435, \u043d\u0430\u0432\u044f\u0437\u044b\u0432\u0430\u0435\u043c\u043e\u043c \u0432 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 Microsoft Azure | ProHoster","og:description":"\u041a\u043b\u0438\u0435\u043d\u0442\u044b \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Microsoft Azure, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 Linux \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e (CVE-2021-38647), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-17T08:22:35+00:00","article:modified_time":"2021-09-17T08:22:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101307","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-17 08:49:36","updated":"2022-10-07 00:05:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/101307","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=101307"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/101307\/revisions"}],"predecessor-version":[{"id":172940,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/101307\/revisions\/172940"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=101307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=101307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=101307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}