Agents installed by default on Azure Linux virtual machines are vulnerable to a remote code execution flaw that can be exploited with a single request.

CVE-2021-38647 (OMIGOD): Critical Flaw Leaves Azure Linux VMs Vulnerable to Remote Code Execution

Open Management Infrastructure Remote Code Execution Vulnerability

The Microsoft Open Management Infrastructure service detected on the remote host is affected by a remote code execution vulnerability due to insufficient authentication validation. An unauthenticated, remote attacker can exploit this to execute code on the remote host as root.

The version of Microsoft Open Management Infrastructure (OMI) package installed on the remote host is prior to 1.6.8-1. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability exists in the OMI agent. An unauthenticated, remote attacker can exploit     this to bypass authentication and execute arbitrary commands with root privileges. (CVE-2021-38647)     
  - Multiple privilege escalation vulnerabilities exists in the OMI agent. An unauthenticated, remote attacker can     exploit this, to gain privileged access to the system. (CVE-2021-38645, CVE-2021-38648, CVE-2021-38649)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Azure Open Management Infrastructure installed on the remote host is prior to 1.6.8.1. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability exists in the OMI agent. An unauthenticated, remote attacker can exploit     this to bypass authentication and execute arbitrary commands with root privileges. (CVE-2021-38647)     
  - Multiple privilege escalation vulnerabilities exists in the OMI agent. An unauthenticated, remote attacker can     exploit this, to gain privileged access to the system. (CVE-2021-38645, CVE-2021-38648, CVE-2021-38649)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
153486	Microsoft Open Management Infrastructure RCE (CVE-2021-38647)	Nessus	Web Servers	critical
153475	Microsoft Open Management Infrastructure (OMI) package < 1.6.8-1 Multiple Vulnerabilities	Nessus	Misc.	critical
153474	Microsoft Open Management Infrastructure < 1.6.8.1 Multiple Vulnerabilities	Nessus	Web Servers	critical

Detections

Analytics

CVE-2021-38647

critical

Tenable Plugins

critical

critical

critical