Tenable, a cybersecurity and exposure management company, discovered a serious security flaw in Microsoft Copilot Studio. The vulnerability is a server-side request forgery (SSRF), which allows unauthorized access to internal resources and sensitive data. Tenable’s research team uncovered the issue during routine investigations into cloud-based applications and services.

The flaw enables attackers to manipulate server requests and potentially access cross-tenant data without proper authentication. Improper handling of redirect status codes caused the SSRF issue in user-configurable actions within Copilot Studio. When Copilot Studio workflows follow redirects insecurely, attackers can exploit that to force internal server actions.

This allows attackers to trick the server into sending unauthorized HTTP requests to protected internal systems. The vulnerability poses serious risks to internal services that were never intended to be exposed externally. It follows other recent discoveries in Microsoft services like Azure Health Bot and Azure API Management.

These findings indicate a trend of similar flaws across Microsoft’s cloud service offerings. SSRF vulnerabilities are especially dangerous in cloud platforms with complex internal resource architectures. They allow attackers to extract metadata and access tokens used for authentication and resource management.

Attackers could reach sensitive components such as Azure’s Instance Metadata Service (IMDS) and Cosmos DB. IMDS provides cloud resource metadata, which can include access credentials or other sensitive environment information. Tenable confirmed they accessed managed identity tokens from IMDS using this vulnerability. No additional information beyond normal Copilot Studio usage was needed to exploit the vulnerability.

This highlights how attackers can abuse trusted internal services without requiring full application access. Jimi Sebree, Tenable’s senior research engineer, emphasized the risk of rushing product development. He stated that companies often prioritize being first in market over ensuring proper security testing. This flaw reflects a growing concern about security in rapidly evolving cloud-based software platforms.

Tenable’s research warns that rushing cloud products can lead to repeated, avoidable vulnerabilities. Microsoft acknowledged the issue and issued a fix on July 31, 2024. The company confirmed the issue was resolved and required no action from users or customers.

Related post

View all