CVE-2021-38648 — Microsoft Open Management Infrastructure (OMI) PrivEsc
What this checks: whether a Microsoft Open Management Infrastructure (OMI) host runs a version affected by unauth OMI version leak via WS-Man Identify (OMIGOD priv-esc). Read-only: it fingerprints Microsoft Open Management Infrastructure (OMI) and reads the version, no exploitation.
3. Detection — reads the Microsoft Open Management Infrastructure (OMI) version from the version exposed at /wsman, compares to 1.6.8-1. Flags vulnerable on an affected build. No exploitation.
1. Target List — paste your Microsoft Open Management Infrastructure (OMI) URLs here, one per line (e.g. https://host.example.com).
Overview
This workflow finds Microsoft Open Management Infrastructure (OMI) and sorts each host by whether its ProductVersion falls below the CVE-2021-38648 OMIGOD floor. CVE-2021-38648 is elevation of privilege in OMI on vulnerable builds. This check never posts a SOAP Identify body and never runs a privilege-escalation exploit. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs /wsman only, fingerprints OMI from WS-Man markers such as ProductVendor and ProductVersion, parses the version, and compares it to floor 1.6.8-1. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. There is no auth-bypass confirm and no second request.
Run it on a schedule when Linux agents turn over. A rebuilt Azure VM image that still ships a pre-1.6.8-1 OMI package is the reason the same fingerprint stays useful.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
GET /wsman on each host and fingerprint OMI from markers such as IdentifyResponse, ProductVendor, Microsoft, ProductVersion, and wsmid.
Parse ProductVersion and compare it to the CVE-2021-38648 floor 1.6.8-1 in the graph.
Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, vulnerable, and errors.
Inputs
Target scope. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether OMI was detected, the version read, the vulnerable flag, and detail text.
findings.jsonl. The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
summary.json. Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.
Integrations
HTTP. Unauthenticated GET of /wsman only. No SOAP Identify POST and no privilege-escalation exploit.
Sample output
The records below are illustrative and do not come from a real run. They show one OMI host below the CVE-2021-38648 floor, one at or above it, and one host that is not the product.
Builds below floor 1.6.8-1, the single FIXED floor coded in the graph. The compare uses the ProductVersion string the /wsman response itself served.
Does an affected row mean OMIGOD privilege escalation ran?
No. The check only GETs /wsman and reads ProductVersion. It does not post a SOAP Identify request and it does not confirm privilege escalation.
Is this check safe on production?
Yes. It is a read-only unauthenticated GET of /wsman. It does not log in or escalate privileges.
Does the check need credentials?
No. It fingerprints the public WS-Man surface the way an external scanner would.
What is CVE-2021-38648?
OMIGOD elevation of privilege in Microsoft Open Management Infrastructure on vulnerable builds. This workflow maps hosts to that CVE by version exposure only.