# “Secret” Agent Exposes Azure Customers To Unauthorized Code Execution

OMI agent in Azure services trusts requests lacking an Authorization header, defaulting privileges to root, enabling unauthenticated RCE on exposed port 5986.

- Payout: Real-world hack
- Severity: critical
- Program: Azure OMI
- Analysis by: Wiz Research
- Disclosed: 2021-09-14
- CVE: CVE-2021-38647, CVE-2021-38648, CVE-2021-38645, CVE-2021-38649
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/secret-agent-exposes-azure-customers-to-unauthorized-code-execution
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-secret-agent-exposes-azure-customers-to-unauthorized-code-execution
- Tags: area:cloud domain:cloud impact:mass-exploit impact:privesc impact:rce kind:incident platform:threat-intel sev:critical tech:linux technique:source-review vuln:auth-bypass vuln:rce

**Target:** OMI management agent HTTP/HTTPS API (ports 5985/5986/1270)
**Root cause:** A conditional-statement coding mistake combined with an uninitialized auth struct causes any request without an Authorization header to default privileges to uid=0, gid=0 (root).
**Steps:**
1. Identify a host with OMI listening on 5985/5986/1270 (default when installed standalone, Azure Configuration Management, or SCOM).
2. Send an OMI command-execution HTTP request to the OMI endpoint with the Authorization header removed.
3. Server processes the request as root (uid=0, gid=0) and executes the command.
**How found:** Wiz researchers audited the silently deployed OMI agent and noticed that omitting the Authorization header unexpectedly succeeded, tracing it to a conditional-statement bug plus uninitialized auth struct defaulting to root.
**Exploitation:** Attacker sends a single unauthenticated packet to the exposed OMI HTTPS port with the Authorization header stripped; OMI treats the request as root and executes arbitrary commands, yielding remote code execution as root (e.g., ransomware, cryptomining, DDoS botnet enrollment).
**Escalation:** With root on an internet-exposed OMI host, attackers pivot laterally to other machines in the Azure environment; local-only deployments still allow low-privileged users to escalate to root.
**Insight:** When auditing agents with custom auth handlers, test requests that omit the auth header entirely rather than sending malformed credentials—uninitialized struct defaults can silently grant the highest privilege.

## Write-ups of the same bug (oldest first)
- 2021-09-14: [OMIGOD: Critical Vulnerabilities in OMI Affecting Countless Azure Customers](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-omigod-critical-vulnerabilities-in-omi-azure) — Wiz Research
- 2021-09-14: [“Secret” Agent Exposes Azure Customers To Unauthorized Code Execution](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-secret-agent-exposes-azure-customers-to-unauthorized-code-execution) — Wiz Research (this one)