Exploitation of CVE-2021-38647 (OMIGOD) in Open Management Infrastructure

CVE-2021-38647, commonly referred to as OMIGOD, is a critical authentication bypass vulnerability within the Open Management Infrastructure (OMI) framework. OMI is an open-source management interface frequently deployed across Microsoft Azure services. The vulnerability manifests due to improper validation of the Authorization header in incoming requests. Remote, unauthenticated attackers can exploit this flaw by sending specifically crafted SOAP requests to the OMI management service, which runs on ports 1270, 5985, or 5986. By omitting the Authorization header entirely, an attacker can invoke administrative methods, most notably the ExecuteScript method, to achieve remote code execution with root privileges on the target system. The recent surfacing of functional proof-of-concept code on public platforms increases the risk to unpatched infrastructure globally. Given the widespread integration of OMI in Azure management components, defenders must prioritize identifying and patching instances where this framework is active.

Attack Chain

1. Attacker performs reconnaissance to identify systems running the OMI management service, typically listening on TCP ports 1270, 5985, or 5986.
2. Attacker crafts a malicious SOAP request targeted at the /wsman endpoint, specifically designed to invoke the ExecuteScript method within the SCX_OperatingSystem namespace.
3. Attacker omits the mandatory Authorization header from the HTTP request, exploiting the flawed logic in the OMI authentication handler.
4. The OMI service receives the request and, due to the missing header, erroneously processes the request as if it were authenticated by a trusted user.
5. The OMI service passes the provided Script argument, often Base64 encoded, to the underlying operating system for execution.
6. The shell script executes with high-level privileges (root) on the target host.
7. Attacker receives the output of the executed commands via the HTTP response body from the OMI service, confirming successful exploitation.

Impact

Successful exploitation of CVE-2021-38647 grants an attacker full remote code execution capabilities with root privileges. This impact extends across several critical Microsoft Azure services, including Azure Automation State Configuration, Azure Automation Update Management, Azure Diagnostics, and Azure Security Center. Compromise allows for total system takeover, data exfiltration, and the ability to pivot laterally within the Azure environment.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Update all vulnerable instances of Open Management Infrastructure (OMI) to the latest patched version provided by Microsoft to eliminate the underlying vulnerability.
• Deploy network-based detection to monitor for HTTP requests to ports 1270, 5985, or 5986 that lack an 'Authorization' header.
• Implement the Zeek detection package provided by Corelight, which specifically looks for missing 'Authorization' headers in WSMAN traffic.
• Enable detailed logging for WSMAN traffic to identify requests containing 'ExecuteScript' payloads within the SOAP body.
• Use the provided Zeek notification logic to audit for successful 'EXPLOIT_RESPONSE' events that return command output (e.g., 'uid=0(root)').
• Block inbound traffic to OMI management ports from untrusted networks at the perimeter firewall.