# OMIGOD: Critical Vulnerabilities in OMI Affecting Countless Azure Customers

OMI agent in Azure trusts requests lacking an Authorization header, defaulting AuthInfo to uid/gid 0, enabling unauthenticated root RCE and local privilege escalation.

- Payout: Research
- Severity: critical
- Program: Microsoft Azure OMI
- Credited: Wiz Research
- Disclosed: 2021-09-14
- CVE: CVE-2021-38647, CVE-2021-38648, CVE-2021-38645, CVE-2021-38649
- Write-up quality: 9/10
- Original: https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-omigod-critical-vulnerabilities-in-omi-azure
- Tags: domain:cloud impact:privesc impact:rce kind:research platform:threat-intel sev:critical tech:azure tech:linux technique:source-review vuln:auth-bypass vuln:privilege-escalation vuln:race-condition vuln:rce

**Target:** OMI agent (omiserver/omiengine) WSMan HTTP endpoint and UNIX socket
**Root cause:** Http_SR_SocketData is memset to 0 so AuthInfo defaults to uid=0/gid=0; _ReadData only checks authFailed when no Authorization header, so requests without auth are processed as root. omiengine forwards unhandled message tags to omiserver without validating auth state.
**Steps:**
1. Send `POST /wsman/ HTTP/1.1` to port 5986 with SOAP ExecuteShellCommand body for `id` and NO Authorization header
2. Server returns 200 with `StdOut=uid=0(root)`
3. For LPE: connect to `/var/opt/omi/run/omiserver.sock`, skip auth handshake, send ExecuteShellCommand request directly
4. For CVE-2021-38645: race a malserver auth-success response with uid=0/gid=0 for guessed client socket id (<10) before omiserver responds
**How found:** Team examined OMI traffic with Burp, noticed basic SOAP protocol, hypothesized behavior without Authorization header, and confirmed 200 root response instead of expected 401; then read source to find memset AuthInfo and _ReadData logic bug.
**Exploitation:** Single unauthenticated HTTP request to exposed WSMan port 5986/5985/1270 executes arbitrary commands as root; local users skip the omiengine auth handshake to run commands as root; race condition via forged auth-success response sets uid/gid to 0.
**Escalation:** Exposed HTTPS port enables initial access and lateral movement across Azure VMs; local LPEs chain after low-priv foothold.
**Insight:** When a service returns 401 for bad credentials, always test omitting the auth header entirely — uninitialized/memset structs can default to privileged identities; also audit frontend/backend proxies that forward unhandled message tags without validating auth state.