CVE-2021-38647 — Microsoft Open Management Infrastructure (OMI) RCE
What this checks: whether a Microsoft Open Management Infrastructure (OMI) host runs a version affected by unauth WS-Man RCE via missing authorization on /wsman. Read-only: it fingerprints Microsoft Open Management Infrastructure (OMI) and reads the version, no exploitation.
3. Detection — reads the Microsoft Open Management Infrastructure (OMI) version from the version exposed at /wsman, compares to 1.6.8-1. Flags vulnerable on an affected build. No exploitation.
1. Target List — paste your Microsoft Open Management Infrastructure (OMI) URLs here, one per line (e.g. https://host.example.com).
Overview
This workflow finds Microsoft Open Management Infrastructure (OMI) and sorts each host by whether its ProductVersion falls below the CVE-2021-38647 OMIGOD floor. CVE-2021-38647 is unauthenticated remote code execution when authorization is missing on the WS-Management endpoint. This check never posts a SOAP Identify body and never runs a command. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs /wsman, fingerprints OMI from WS-Man markers such as ProductVendor and ProductVersion, parses the version, and compares it to floor 1.6.8-1. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. There is no auth-missing exploit and no confirm step.
Run it on a schedule when Linux agents turn over. A rebuilt Azure VM image that still ships a pre-1.6.8-1 OMI package is the reason the same fingerprint stays useful.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
GET /wsman on each host and fingerprint OMI from markers such as IdentifyResponse, ProductVendor, Microsoft, ProductVersion, and wsmid.
Parse ProductVersion and compare it to the CVE-2021-38647 floor 1.6.8-1 in the graph.
Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, vulnerable, and errors.
Inputs
Target scope. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether OMI was detected, the version read, the vulnerable flag, and detail text.
findings.jsonl. The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
summary.json. Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.
Integrations
HTTP. Unauthenticated GET of /wsman only. No SOAP Identify POST and no command execution.
Sample output
The records below are illustrative and do not come from a real run. They show one OMI host below the CVE-2021-38647 floor, one at or above it, and one host that is not the product.
Builds below floor 1.6.8-1 in the graph. The compare uses the ProductVersion string the /wsman response itself served.
Does an affected row mean OMIGOD RCE ran?
No. The check only GETs /wsman and reads ProductVersion. It does not post a SOAP Identify request and it does not confirm unauthenticated RCE.
Is this check safe on production?
Yes. It is a read-only unauthenticated GET of /wsman. It does not log in or execute a command.
Does the check need credentials?
No. It fingerprints the public WS-Man surface the way an external scanner would.
What is CVE-2021-38647?
OMIGOD, unauthenticated remote code execution in Microsoft Open Management Infrastructure when authorization is missing on /wsman. This workflow maps hosts to that CVE by version exposure only.