Loading vulnerability…
CVE-2021-38647 is an unauthenticated remote code execution vulnerability in Open Management Infrastructure (OMI), also known as the OMIGOD flaw. Affected OMI versions earlier than 1.6.8.1 can be exploited by sending a crafted HTTP request to an exposed OMI service endpoint without providing an authorization header. Instead of returning an unauthorized response, the vulnerable service permits invocation of SCXcore RunAs provider functionality, including command-execution paths such as ExecuteShellCommand and ExecuteScript, which execute through /bin/sh. Because the OMI agent commonly runs with root privileges, successful exploitation allows arbitrary command execution as root on the target Linux or UNIX system.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a single Metasploit module (modules/exploits/linux/misc/cve_2021_38647_omigod.rb) that exploits CVE-2021-38647, also known as OMIGOD. The exploit targets the Microsoft Open Management Infrastructure (OMI) service on Linux/Unix systems, specifically versions prior to 1.6.8-1. The vulnerability is an authentication bypass that allows an attacker to send crafted HTTP POST requests (SOAP/XML) to the OMI management endpoint (default /wsman on port 5985) and execute arbitrary operating system commands as root. The module supports both direct command execution and staged payloads (droppers), leveraging Metasploit's CmdStager for more complex payload delivery. The code is written in Ruby and is fully integrated into the Metasploit framework, making it weaponized and easy to use for attackers. The main attack vector is network-based, requiring access to the OMI management port. The module includes references to public advisories and research, and is designed for reliable exploitation with minimal configuration.
This repository is a proof-of-concept (POC) exploit for CVE-2021-38647, a critical vulnerability in Microsoft's Open Management Infrastructure (OMI) service. The repository contains two files: a README.md explaining the exploit and usage, and a payload.xml file containing a SOAP envelope. The exploit works by sending a crafted POST request to the /wsman endpoint of a vulnerable OMI service (typically on port 5986), with the payload.xml as the request body. The payload demonstrates remote command execution by running the 'id' command, but the command can be replaced with any desired shell command. The main fingerprintable endpoint is the HTTP URL (http://192.168.1.1:5986/wsman/), which should be changed to the actual target. The exploit does not include automation scripts; it is intended as a manual POC to demonstrate the vulnerability.
This repository contains a proof-of-concept exploit for CVE-2021-38647 (OMIGOD), a critical unauthenticated remote code execution vulnerability in the Microsoft OMI agent (Open Management Infrastructure) commonly deployed on Azure Linux servers. The repository consists of a Python script (omigod.py) and a README.md. The exploit script constructs and sends a malicious SOAP request to the OMI agent's WS-Man endpoint (default TCP port 5986 over HTTPS), injecting an arbitrary shell command for execution as root. The script takes the target IP address and the desired command as arguments, then prints the command's output and error. The README provides usage instructions, mitigation advice, and background information. The exploit is operational, allowing attackers to execute arbitrary commands remotely and unauthenticated, provided the target is running a vulnerable OMI agent version. The main fingerprintable endpoint is the WS-Man service at https://<target>:5986/wsman.
This repository provides a proof-of-concept (POC) exploit for CVE-2021-38647, also known as OMIGOD, which is an unauthenticated remote code execution vulnerability in Microsoft's Open Management Infrastructure (OMI) service, commonly installed on Azure UNIX/Linux VMs. The repository contains two main exploit scripts: a Python script (CVE-2021-38647.py) and a PowerShell script (Invoke-CVE-2021-38647.ps1). Both scripts allow an attacker to send specially crafted SOAP requests to the OMI service over HTTPS (default port 5986), exploiting the lack of authentication to execute arbitrary shell commands or scripts as root on the target system. The Python script is command-line driven, while the PowerShell script is designed for use in Windows environments. The README provides detailed usage instructions, background on the vulnerability, and references for further reading. No detection or mitigation scripts are included; the focus is on exploitation. The exploit is a POC and requires the attacker to specify the target IP, port, and command or script to execute. The repository is well-structured, with clear separation between code, documentation, and licensing.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote code execution vulnerability in OMI (Open Management Infrastructure) used in Azure and Linux environments, allowing attackers to execute arbitrary code remotely.
An unauthenticated remote code execution vulnerability in the Open Management Infrastructure (OMI) framework that allows arbitrary command execution as root on vulnerable OMI agents prior to version 1.6.8.1 via crafted HTTP/HTTPS requests.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.