Exploit for #VU56504 Code Injection in Azure Open Management Infrastructure

Vulnerability identifier: #VU56504

Vulnerability risk: High

CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2021-38647

CWE-ID: CWE-94

Exploitation vector: Network

Exploits in database: 11

• October 28, 2021
  • Microsoft OMI Management Interface Authentication Bypass [Metasploit]
• September 28, 2021
  • omigod (Quick and dirty CVE-2021-38647 (Omigod) exploit written in Go.) [Github]
• September 25, 2021
  • OMIGOD_cve-2021-38647 (CVE-2021-38647 is an unauthenticated RCE vulnerability effecting the OMI agent as root.) [Github]
• September 22, 2021
  • CVE-2021-38647 (OMIGOD PoC) [Github]
  • CVE-2021-38647 (CVE-2021-38647 AKA "OMIGOD" vulnerability in Windows OMI ) [Github]
  • CVE-2021-38647 (CVE-2021-38647 - POC to exploit unauthenticated RCE #OMIGOD) [Github]
• September 21, 2021
  • omigood (OMIGOD! OM I GOOD? A free scanner to detect VMs vulnerable to one of the "OMIGOD" vulnerabilities discovered by Wiz's threat research team, specifically CVE-2021-38647.) [Github]
• September 19, 2021
  • CVE-2021-38647-POC-and-Demo-environment (OMIGod / CVE-2021-38647 POC and Demo environment) [Github]
• September 16, 2021
  • CVE-2021-38647 (CVE-2021-38647 POC for RCE) [Github]
  • cve-2021-38647 (A PoC exploit for CVE-2021-38647 RCE in OMI) [Github]
  • CVE-2021-38647 (Proof on Concept Exploit for CVE-2021-38647 (OMIGOD)) [Github]

Vulnerable software:
Azure Open Management Infrastructure
Other software / Other software solutions

Vendor: Microsoft