In the past year, Wiz Research has shed light on cloud middleware, software that brokers between customer workloads and cloud providers’ managed services. The task of updating middleware software is not well defined by the cloud shared responsibility model and customers are often unaware of its existence and the attack surface it may expose.
As new vulnerabilities are discovered in cloud middleware software such as Microsoft OMI (Open Management Infrastructure), used by multiple popular Azure services (Azure Automation, Azure Log analytics Azure Sentinel and more), vendors release patches and customers are required to manually install them. Recently, as part of Microsoft’s June 2022 Patch Tuesday, an update was included to fix CVE-2022-29149, a new local privilege escalation vulnerability in OMI.
Wiz investigated this vulnerability, validated its exploitability, and identified gaps in the details shared about the issue and its detection. To reduce the risk associated with cloud middleware, we shared our research insights with Azure and worked closely with them to improve patching processes for customers.
Today, we are happy to share that this cooperation culminated in coordinated release of updates to 3 OMI dependent agents; Azure’s Operations Management Suite (OMS) agent, Desired State Configuration (DSC) agent and Azure Diagnostics (LAD) agent are now onboarded on to the Automatic Extension Upgrade capability, that will enable cloud customers to opt-in to automatic updates for these agents. When these agents are updated, OMI is also automatically updated.
We urge Azure customers to use the new capabilities and enable automatic updates for the OMS, Azure Diagnostics and Desired State Configuration agents if possible. Automatic Extension Upgrade will ensure that customers receive security updates to these agents as soon as patches are released without manual overhead.
Our goal in Wiz research is to improve the security of the cloud and we thank the Azure team for their collaboration and shared pursuit of our common goal to protect cloud customers.
See our technical blog for further analysis of CVE-2022-29149, detection instructions, and remediation guidance for Wiz customers and Azure customers.
What is cloud middleware?
Cloud middleware is software often installed by CSPs when customers onboard services, without the customers being aware of it. Cloud middleware may require high privilege access. A combination of lack of customer awareness and high privilege access may expose customer environments in case of vulnerabilities.
Software of this nature increases the attack surface of cloud environments, potentially exposing customers to local privilege escalation and remote code execution vulnerabilities. Cloud middleware is usually unknown to customers and is therefore disregarded. The current shared responsibility model does not clearly define who is responsible for securing the middleware layer, and as a result customers do not address the associated risks, leaving their cloud environments vulnerable even after fixes are available.
To learn more about cloud middleware and its effect on cloud customers' security posture, you can read our latest blog post on the subject.
What is OMI?
OMI (Open Management Infrastructure) is a notable example of cloud middleware in Azure. It is an open-source project sponsored by Microsoft in collaboration with The Open Group. Essentially, it is Windows Management Infrastructure (WMI) for UNIX/Linux systems. OMI allows you to gather statistics and sync configurations across your environment. Thanks to the ease of use and abstraction that OMI provides, it sits behind the scenes of many popular Azure services including Open Management Suite (OMS), Azure Linux Diagnostic (LAD), Azure Desired State Configuration (DSC), Container Monitoring Solution in Azure Monitor, Azure Automation, and more. While the presence of OMI is documented by Azure, customers may not be aware of this.
Wiz Research found and reported the previous four vulnerabilities in OMI in June 2021, including an unauthenticated remote code execution vulnerability dubbed “OMIGOD” (CVE-2021-38647).
Wiz and Azure collaborate to secure customers
As part of June 2022 Patch Tuesday, Microsoft published a patch to fix a new privilege escalation vulnerability, CVE-2022-29149, in OMI, with a CVSS score of 7.8.
Following the vulnerability’s publication, we noticed that MSRC required customers to manually update the agents dependent on OMI or OMI as a stand-alone package to the new version but did not provide detailed instructions on how to detect vulnerable instances. Also, customers were being asked to patch software that they likely did not know was installed in their environment. Our research also showed low patch rates across in a sample of Azure enterprise environments, likely due to the above.
We investigated the issue and successfully developed an exploit proof of concept for CVE-2022-29149 that was fixed by the patch. We then shared our findings with Microsoft illustrating that such prevalent and exploitable vulnerabilities would make unpatched instances attractive targets for attackers, and that customers don’t even know that they need to patch or how to do so properly.
As a result, On July 7, 2022, Azure updated the MSRC advisory to include more details about the vulnerability, affected services and remediation. In addition, Microsoft notified affected customers directly through the Azure Service Health Notifications. Since this is not the first case where Microsoft proposed a manual update to middleware agents, we also discussed with the Azure team long-term solutions to prevent the risks of vulnerable cloud middleware:
Assigning a CPE to OMI – a CPE identifier to OMI that will be associated with OMI CVEs will enable vulnerability management solutions detect vulnerabilities in OMI automatically.
Introducing an opt-in auto-update mechanism for agents using OMI that will enable customers to patch their resources without manual work. Such a solution will bridge the cloud middleware knowledge gap and provide customer with patched resources.
Microsoft has quickly onboarded 3 OMI dependent agents to the Automatic Extension Upgrade capability; OMS agent, Azure Diagnostics agent and Desired State Configuration agent. When this feature is enabled by customers on their environments, the OMS agent, Azure Diagnostics agent and Desired State Configuration agent and subsequently, OMI that is installed with them can be updated as soon as a new version is introduced.
Aftermath
We are encouraged that Microsoft are releasing support for the Automatic Extension Upgrade feature for agents dependent on OMI. This reduces the risk of cloud middleware vulnerabilities remaining unpatched for years. We join Microsoft’s recommendation and urge customers enable automatic updates for the OMS, Azure Diagnostics and Desired State Configuration agents and encourage customers to migrate to Azure Monitoring Agent, which does not rely on OMI. Automatic Extension Upgrade will ensure that Azure customers get any important security updates to these agents as soon as possible with no manual overhead.
We appreciate the collaboration with the Microsoft team and look forward to seeing more progress across all CSPs in providing solutions to reduce the risks of cloud middleware.
This blogpost was written by the Wiz Research Team, as part of our ongoing mission to analyze threats to the cloud, build mechanisms that prevent and detect them, and fortify cloud security strategies.
