CVE-2021-38647
Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Description
CVE-2021-38647 is a CRITICAL remote code execution vulnerability in Microsoft Open Management Infrastructure (OMI) with a CVSS 3.1 score of 9.8. Also known as "OMIGOD," this vulnerability allows unauthenticated remote attackers to execute arbitrary code as root on Linux machines running OMI, which is silently installed on Azure virtual machines through various Azure VM management extensions. Affected products include Azure Automation State Configuration, Azure Automation Update Management, Azure Diagnostics (LAD), Azure Open Management Infrastructure, Azure Security Center, Azure Sentinel, Azure Stack Hub, Container Monitoring Solution, Log Analytics Agent, and System Center Operations Manager. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. The vulnerability is known to be leveraged in ransomware campaigns. With an EPSS score of 0.94392 (99.97th percentile), this vulnerability demonstrates the highest levels of real-world exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | azure automation state configuration | - |
| microsoft | azure automation update management | - |
| microsoft | azure diagnostics \(lad\) | - |
| microsoft | azure security center | - |
| microsoft | azure sentinel | - |
| microsoft | azure stack hub | - |
| microsoft | container monitoring solution | - |
| microsoft | log analytics agent | - |
| microsoft | open management infrastructure | < 1.6.8-1 |
| microsoft | system center operations manager | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647(Patch, Vendor Advisory)
- http://packetstormsecurity.com/files/164694/Microsoft-OMI-Management-Interface-Authentication-Bypass.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38647(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38647(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
CVE-2021-38647 exploits an authentication bypass in the OMI HTTP/HTTPS listener. When OMI receives management requests over its listening port, requests that omit the authentication header entirely are processed as having the highest privileges (root). This means an attacker can send a specially crafted SOAP/XML request to the OMI port without any credentials and achieve remote code execution with root privileges. The vulnerability arises from improper validation of the authentication context in incoming requests, where a missing authentication header is treated as an implicitly trusted request rather than being rejected.
Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2021-38647 carries a CVSS 3.1 score of 9.8 (CRITICAL) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants root-level access to the underlying Linux system, allowing attackers to read all files, access credentials, encryption keys, and any data processed by Azure services running on the VM.
Integrity (HIGH): With root access, attackers can modify any system files, install persistent backdoors, alter application configurations, deploy malware, or pivot to connected Azure resources and services.
Availability (HIGH): Complete system compromise enables attackers to disrupt all services running on the VM, deploy ransomware, destroy data, or use the compromised system to attack other resources in the Azure environment.
Scope Unchanged: While technically scoped to the OMI component, root access on the host effectively compromises the entire VM and potentially connected Azure services.
With an EPSS score of 0.94392 (99.97th percentile), this is one of the most actively exploited vulnerabilities tracked, demanding the highest remediation priority.
Exploit Maturity
CVE-2021-38647 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: Public exploit code is widely available. The vulnerability was disclosed in September 2021 as part of the "OMIGOD" set of OMI vulnerabilities (alongside CVE-2021-38648, CVE-2021-38645, CVE-2021-38649). Exploitation is trivial, requiring only a single HTTP request without authentication. Proof-of-concept exploits were published within days of disclosure.
Ransomware association: This vulnerability is known to be leveraged in ransomware campaigns. The combination of unauthenticated remote code execution as root, silent installation on Azure VMs, and broad exposure made it an immediate target for cryptocurrency miners, botnet operators, and ransomware groups.
Attack surface: OMI is silently installed on Azure Linux VMs when using services like Azure Automation, Azure Security Center, Log Analytics, and others. Many Azure customers were unaware OMI was installed on their systems. OMI listens on ports 5985 (HTTP) and 5986 (HTTPS) and may be exposed to the internet depending on network security group configurations.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2021-11-17.
Remediation
- Update OMI to version 1.6.8.1 or later immediately. Apply updates per vendor instructions. Consult the Microsoft Security Advisory at MSRC for specific patch guidance. Note that Azure VM extensions may need to be updated independently.
- Identify all systems running OMI in your environment. OMI is silently installed by various Azure VM extensions. Check for the presence of OMI on all Azure Linux VMs, especially those using Azure Automation, Security Center, Log Analytics, Sentinel, or Container Monitoring.
- Restrict network access to OMI ports. Ensure Network Security Groups (NSGs) block external access to ports 5985 and 5986. These management ports should never be exposed to the internet. Implement strict network segmentation for management interfaces.
- Scan for indicators of compromise. Given the widespread exploitation, review system logs for unexpected processes running as root, unusual network connections from OMI ports, and signs of cryptocurrency miners or backdoors. Check for modifications to critical system files.
- Update Azure VM extensions to the latest versions. Some Azure services automatically update OMI through their extensions. Verify that all VM extensions (OMS Agent, DSC, LAD) are updated to versions that include the patched OMI.
- Implement defense-in-depth monitoring. Deploy host-based intrusion detection, enable Azure Defender for Servers, and configure alerts for anomalous root-level activity on Linux VMs.
Technical Details
CVE-2021-38647 is a CRITICAL-severity vulnerability in Microsoft Open Management Infrastructure (OMI) that can be exploited remotely over the network. The attack complexity is low, requiring no specialized conditions. No authentication or privileges are required. No user interaction is needed.
Technical mechanism: OMI is an open-source Web-Based Enterprise Management (WBEM) implementation used by Azure to manage Linux VMs. The OMI agent listens on ports 5985 (HTTP) and 5986 (HTTPS) for SOAP/XML management requests. The authentication bypass occurs because the OMI daemon fails to properly validate the authentication header in incoming requests. When the authentication header is completely omitted from a request, OMI processes the request with root-level privileges instead of rejecting it. An attacker sends a simple HTTP POST request with a SOAP envelope containing ExecuteShellCommand operations to the OMI port without any authentication, achieving arbitrary command execution as root.
CVSS 3.1 vector analysis: The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the maximum exploitability score of 3.9, with Network Attack Vector, Low Complexity, No Privileges Required, and No User Interaction. The impact is HIGH across all three CIA dimensions.
Affected products: Azure Automation State Configuration, Azure Automation Update Management, Azure Diagnostics (LAD), Azure Open Management Infrastructure, Azure Security Center, Azure Sentinel, Azure Stack Hub, Container Monitoring Solution, Log Analytics Agent, System Center Operations Manager.
Frequently Asked Questions
Is CVE-2021-38647 being actively exploited?
Yes, CVE-2021-38647 (known as OMIGOD) is actively exploited in the wild. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and has an EPSS score of 0.94392 (99.97th percentile). The vulnerability is known to be leveraged in ransomware campaigns, cryptomining operations, and botnet recruitment.
What products are affected by CVE-2021-38647?
Affected products include Azure Automation State Configuration, Azure Automation Update Management, Azure Diagnostics (LAD), Azure Open Management Infrastructure, Azure Security Center, Azure Sentinel, Azure Stack Hub, Container Monitoring Solution, Log Analytics Agent, and System Center Operations Manager. OMI is silently installed by these Azure services on Linux VMs.
How do I fix CVE-2021-38647?
Update OMI to version 1.6.8.1 or later. Update all Azure VM extensions to their latest versions. Block external access to ports 5985 and 5986 via Network Security Groups. Verify that OMI is patched on all Azure Linux VMs, as the agent may be silently installed by multiple Azure services.
How severe is CVE-2021-38647?
CVE-2021-38647 is rated CRITICAL with a CVSS 3.1 score of 9.8. Its EPSS score of 0.94392 places it in the 99.97th percentile for exploitation likelihood. The vulnerability allows unauthenticated remote code execution as root and is confirmed in ransomware campaigns. This is one of the most severe Azure-related vulnerabilities disclosed.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.