CVE-2021-38647: Azure Automation State Config RCE Flaw

CVE-2021-38647 Overview

CVE-2021-38647 is a critical remote code execution vulnerability in Microsoft's Open Management Infrastructure (OMI), a Unix/Linux-based remote management framework deployed across numerous Azure services. This vulnerability, commonly referred to as "OMIGOD," allows unauthenticated attackers to execute arbitrary commands with root privileges on vulnerable systems by sending specially crafted HTTP requests to the OMI service.

The vulnerability arises from an authentication bypass flaw in the OMI service, which listens on ports 5985, 5986, or 1270 depending on configuration. When OMI is exposed to the network, attackers can exploit this flaw without any credentials, making it particularly dangerous in cloud environments where OMI is automatically installed as part of various Azure management extensions.

Critical Impact

Unauthenticated remote attackers can achieve root-level code execution on vulnerable Azure Linux VMs and on-premises systems running OMI, potentially leading to complete system compromise, data exfiltration, and lateral movement within cloud environments.

Affected Products

• Microsoft Azure Automation State Configuration
• Microsoft Azure Automation Update Management
• Microsoft Azure Diagnostics (LAD)
• Microsoft Azure Open Management Infrastructure
• Microsoft Azure Security Center
• Microsoft Azure Sentinel
• Microsoft Azure Stack Hub
• Microsoft Container Monitoring Solution
• Microsoft Log Analytics Agent
• Microsoft System Center Operations Manager

Discovery Timeline

• September 15, 2021 - CVE-2021-38647 published to NVD
• October 30, 2025 - Last updated in NVD database

Technical Details for CVE-2021-38647

Vulnerability Analysis

The OMIGOD vulnerability exists in the authentication mechanism of the Open Management Infrastructure agent. The OMI agent is a lightweight WS-Management protocol implementation for Linux systems that enables remote management operations similar to Windows Management Instrumentation (WMI).

The core issue lies in how the OMI service handles incoming HTTP requests. When processing authentication headers, the service fails to properly validate the Authorization header. If the header is simply omitted or set to an empty value, the OMI service defaults to treating the request as authenticated with root privileges. This design flaw means that by removing or nullifying authentication information, an attacker paradoxically gains elevated access.

The vulnerability affects the omiserver process which, when configured with HTTPS management ports exposed externally, can be reached directly over the network. In Azure environments, many customers were unknowingly exposed because OMI was installed automatically as a dependency of popular Azure extensions without explicit notification.

Root Cause

The root cause of CVE-2021-38647 is an authentication bypass vulnerability stemming from improper handling of the Authorization header in HTTP requests to the OMI agent. The OMI codebase incorrectly assumes that the absence of an authentication header indicates a trusted local connection, defaulting to root-level privileges. This flawed logic allows remote attackers to bypass authentication entirely by omitting credentials from their requests. The vulnerability represents a fundamental design flaw in the authentication validation logic rather than a simple implementation bug.

Attack Vector

The attack vector for CVE-2021-38647 is network-based and requires no user interaction or privileges. An attacker can exploit this vulnerability by sending a malicious SOAP envelope to the OMI service's HTTP(S) endpoint. The attack works by crafting an ExecuteShellCommand request wrapped in a WS-Management SOAP message, omitting the Authorization header entirely.

When the OMI service receives this request, it processes the command with root privileges due to the authentication bypass. The attacker can execute arbitrary shell commands, install malware, create backdoor accounts, pivot to other systems, or exfiltrate sensitive data from the compromised host.

The vulnerability is particularly severe because:

• No authentication is required
• Commands execute as root
• Many Azure services silently install OMI
• Network exposure may be unintentional
• The attack can be automated at scale

For technical details on the exploitation mechanism, refer to the Packet Storm Security Exploit documentation and the Microsoft Security Advisory.

Detection Methods for CVE-2021-38647

Indicators of Compromise

• Unexpected HTTP requests to OMI ports (5985, 5986, or 1270) from external IP addresses
• SOAP requests containing ExecuteShellCommand operations without valid Authorization headers
• Unusual root-level process spawning from the omiserver process
• New user accounts or SSH keys added to the system without authorization
• Outbound network connections from omiserver to unknown external destinations

Detection Strategies

• Monitor network traffic for requests to OMI management ports (TCP 5985, 5986, 1270) from untrusted sources
• Implement host-based detection rules for suspicious process trees originating from the OMI agent
• Deploy SIEM rules to detect SOAP envelopes containing ExecuteShellCommand class operations
• Enable audit logging for the /opt/omi/ directory and OMI configuration changes

Monitoring Recommendations

• Audit all Azure Linux VMs to identify instances running vulnerable OMI versions using dpkg -l omi or rpm -qa omi
• Continuously monitor firewall logs for connection attempts to OMI ports from external networks
• Enable Azure Defender for Servers to receive alerts on suspicious activity related to OMI exploitation
• Review process execution logs for commands spawned by the omiserver parent process

How to Mitigate CVE-2021-38647

Immediate Actions Required

• Update OMI to version 1.6.8.1 or later immediately on all affected systems
• Block external access to OMI ports (5985, 5986, 1270) using network security groups or firewalls
• Review Azure VMs for unauthorized users, SSH keys, or persistent backdoors
• Conduct forensic analysis on any systems that had OMI ports exposed to the internet

Patch Information

Microsoft has released security updates addressing CVE-2021-38647. The patched version of OMI is 1.6.8.1 or later. For Azure services, Microsoft has automatically updated many affected extensions, but customers should verify their OMI version manually.

To check your current OMI version:

/opt/omi/bin/omiserver --version

Refer to the Microsoft Security Advisory CVE-2021-38647 for detailed patching instructions and the complete list of updated Azure extensions. This vulnerability is listed in the CISA Known Exploited Vulnerabilities Catalog, making timely patching mandatory for federal agencies.

Workarounds

• Restrict network access to OMI ports using Azure Network Security Groups (NSGs) with explicit deny rules for inbound traffic
• If OMI is not required, disable or uninstall the omiserver service using systemctl stop omiserver && systemctl disable omiserver
• Implement host-based firewall rules using iptables or firewalld to limit OMI access to localhost only
• For environments where patching is delayed, consider removing the OMI package entirely if the dependent Azure features are not in use

# Block external access to OMI ports using iptables
iptables -A INPUT -p tcp --dport 5985 -j DROP
iptables -A INPUT -p tcp --dport 5986 -j DROP
iptables -A INPUT -p tcp --dport 1270 -j DROP

# Verify OMI version
/opt/omi/bin/omiserver --version

# Disable OMI service if not needed
systemctl stop omiserver
systemctl disable omiserver