{"id":7489,"date":"2021-11-12T19:18:45","date_gmt":"2021-11-13T02:18:45","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7489"},"modified":"2023-04-05T12:37:36","modified_gmt":"2023-04-05T19:37:36","slug":"patch-urgently-microsoft-omigod-vulnerabilities-are-under-active-exploitation","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/patch-urgently-microsoft-omigod-vulnerabilities-are-under-active-exploitation\/","title":{"rendered":"Patch Urgently – Microsoft OMIGOD Vulnerabilities Are Under Active Exploitation!"},"content":{"rendered":"
{Updated on January 25, 2022}: <\/strong>A proof-of-concept to exploit the unauthenticated RCE flaw (CVE-2021-38647<\/a>) has been released into GitHub<\/a>. We urge Azure users to ensure that their systems are up-to-date.<\/p>\n Thousands of Azure users and millions of endpoints are impacted by \u2018OMIGOD\u2019 zero-days,\u201d was the initial outburst when the open-source vulnerabilities were disclosed. Many Azure customers are unwittingly putting themselves in danger.<\/p>\n<\/blockquote>\n <\/p>\n On September 16, Microsoft released a patch for four vulnerabilities in Open Management Infrastructure (OMI)<\/a>, an open-source Common Information Model (CIM) management server used to manage Unix and Linux systems that allow users to manage installations and collect statistics across remote and local environments.<\/p>\n <\/p>\n The identified serious vulnerabilities (CVE-2021-38647<\/a>, CVE-2021-38648<\/a>, CVE-2021-38645<\/a>, and CVE-2021-38649<\/a>) in Microsoft Open Management Infrastructure (OMI) allow an attacker to escalate privileges and run arbitrary code on the compromised machine.<\/p>\n <\/p>\n The significant unauthenticated, remote code execution vulnerability has already produced a slew of proofs-of-concept. Most alarming is that threat actors had quickly imitated the attempts, and CVE-2021-38647 has recently been observed being extensively exploited via botnet operations. We found eight hits from a basic search of the CVE on Github.<\/p>\n <\/p>\n The OMIGOD vulnerability is triggered by automated “on-by-default” Azure agent installations on Linux Virtual Machines (VMs), which brings numerous vulnerabilities into your environment. An attacker can accomplish Remote Code Execution (RCE) by creating and transmitting a packet through HTTPS to a port listening for OMI. This attack is characterized as being exceptionally simple to carry out, as an attacker simply has to eliminate the packet’s authentication header.<\/p>\n <\/p>\n An attacker can use these vulnerabilities to get a maximum of root access to a remote system by exploiting them.<\/p>\n<\/li>\n Merely, running port scans are used to locate devices that are vulnerable on port 5986. This is perhaps done via the open Internet or from within the Azure network, which includes linked VNETs and on-premises networks,<\/p>\n<\/li>\n Consequently, launching an attack to exploit OMIGOD vulnerabilities.<\/p>\n<\/li>\n<\/ul>\n <\/p>\n <\/p>\n According to researchers, some of these exploitation attacks are being carried out by the Mirai botnet, targeting Azure Linux OMI endpoints vulnerable to the CVE-2021-38647 RCE vulnerability. As part of this new Mirai campaign, attackers are deploying a version of the Mirai Distributed Denial of Service botnet.<\/p>\n <\/p>\n All versions of Microsoft Open Management Infrastructure (OMI) prior to v1.6.8.1 are vulnerable. The following is the breakdown of the affected products.<\/p>\n Azure Stack Hub<\/p>\n<\/li>\n Azure Sentinel<\/p>\n<\/li>\n Azure Security Center<\/p>\n<\/li>\n Container Monitoring Solution<\/p>\n<\/li>\n Log Analytics Agent<\/p>\n<\/li>\n Azure Automation Update Management<\/p>\n<\/li>\n Azure Automation State Configuration, DSC Extension<\/p>\n<\/li>\n System Center Operations Manager (SCOM)<\/p>\n<\/li>\n Azure Diagnostics (LAD)<\/p>\n<\/li>\n Azure Open Management Infrastructure<\/p>\n<\/li>\n<\/ul>\n Here is the mapping of vulnerable modules or extensions to associated agents –<\/p>\n\n
Proof-of-Concept: Simple to Execute<\/h2>\n
\n
Open Doors to Mirai Botnet<\/h2>\n
Affected Products<\/h2>\n
\n