Exposure management company Tenable has discovered a critical information disclosure vulnerability in Microsoft’s Copilot Studio via a server-side request forgery (SSRF). The vulnerability allowed researchers access to potentially sensitive information regarding service internals with potential cross-tenant impact.
This vulnerability exists due to improper handling of redirect status codes for user-configurable actions within Copilot Studio. This follows the team’s recent discoveries of flaws in Microsoft’s Azure Health Bot service, Azure Service Tags and three vulnerabilities in the Azure API Management service.
An SSRF vulnerability occurs when an attacker can influence the application into making server-side HTTP requests to unexpected targets or in an unexpected way, for example forcing an application on a remote host to make requests to an unintended location. If an attacker can control the target of those requests, they could point the request to a sensitive internal resource to which the server-side application has access, even if the attacker doesn’t, revealing potentially sensitive information. Had this issue been exploited by a malicious actor, they would have been able to access the internal infrastructure of Copilot Studio, which is a shared environment among customers. This could have allowed access to Azure’s Instance Metadata Service (IMDS), allowing a threat actor to obtain access tokens for the environment and granting further access to other shared resources, such as a Cosmos DB, where sensitive information regarding the internals of Copilot Studio are stored.
“In the context of cloud applications, a common target is the Instance Metadata Service (IMDS), which, depending on the cloud platform, can yield useful, potentially sensitive information for an attacker,” says Tenable’s Jimi Sebree. “In this case, we retrieved managed identity access tokens from the IMDS. No information beyond the usage of Copilot Studio was required to exploit this flaw. As in some of the previous vulnerabilities found by our research team, this vulnerability demonstrates that mistakes can be made when companies rush to be the first to release products in a new or rapidly expanding space.”
Microsoft has confirmed that remediations for this issue were in place as of July 31, 2024, and no customer action is required.
More information, including the team’s technical findings and proof of concept, has been published on the Tenable blog and in the technical advisory.
