Actively exploited · Published Sep 15, 2021 · Assigned by microsoft
CVE-2021-38647Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Critical 9.8 Exploited Ransomware
In plain English
A critical-severity security flaw in Azure Automation State Configuration, DSC Extension from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 99.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)99.9%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack tooling3Metasploit, Nuclei, Public PoC
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Nov 17, 2021.
Official description
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Azure Automation State Configuration, DSC Extension | 2.0.0 – before DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 |
| Microsoft | Azure Automation Update Management | 1.0.0 – before OMS Agent for Linux GA v1.13.40-0 |
| Microsoft | Azure Diagnostics (LAD) | 3.0.0 – before LAD v4.0.13 and LAD v3.0.135 |
| Microsoft | Azure Security Center | 1.0.0 – before OMS Agent for Linux GA v1.13.40-0 |
| Microsoft | Azure Sentinel | 1.0.0 – before OMS Agent for Linux GA v1.13.40-0 |
| Microsoft | Azure Stack Hub | 1.0.0 – before Monitor, Update and Config Mgmnt 1.14.01 |
| Microsoft | Container Monitoring Solution | 1.0.0 – before publication |
| Microsoft | Log Analytics Agent | 1.0.0 – before OMS Agent for Linux GA v1.13.40-0 |
| Microsoft | Open Management Infrastructure | 16.0 – before OMI Version 1.6.8-1 |
| Microsoft | System Center Operations Manager (SCOM) | 1.0.0 – before OMI version: 1.6.8-1 |
References
- Open Management Infrastructure (OMI) Remote Code Execution Vulnerability vendor-advisory, patch
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38647 x_refsource_MISC, x_transferred
- http://packetstormsecurity.com/files/164694/Microsoft-OMI-Management-Interface-Authentication-Bypass.html x_refsource_MISC, x_transferred
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38647 government-resource