Cross-Tenant Data Exfiltration in Azure OpenAI Studio via WebSocket Manipulation
Overview
A critical information disclosure vulnerability was discovered in the Microsoft Azure OpenAI Studio web interface. The vulnerability allowed an authenticated attacker to access sensitive data from other tenants' active 'Playground' sessions. The root cause was an improper authorization check on the WebSocket channel used to stream real-time responses from the language models. An attacker, logged into their own Azure tenant, could initiate a legitimate Playground session and then use browser developer tools to intercept and modify the WebSocket handshake request. By replacing their own session ID with a valid but guessed session ID from a victim tenant, the attacker's client could successfully subscribe to the victim's WebSocket stream. This resulted in the attacker receiving all prompts and model-generated completions from the victim's session in real-time. This could lead to the exposure of highly sensitive information, such as proprietary source code, business plans, personal data, and other intellectual property being tested in the Playground. The vulnerability highlighted a critical flaw in the multi-tenant architecture's data segregation. Microsoft has since patched the vulnerability by enforcing strict tenant-level authorization on every WebSocket connection.
Affected Systems
Testing Guide
This vulnerability was patched by Microsoft and can no longer be tested. A conceptual test would have involved: 1. **Two Azure Accounts:** Log into two different Azure OpenAI tenants in separate browser sessions (Attacker and Victim). 2. **Start Victim Session:** In the Victim browser, start a new chat in the Playground. 3. **Capture Attacker WebSocket:** In the Attacker browser, start a chat and use developer tools to capture the WebSocket connection request, noting the session ID. 4. **Modify and Replay:** Modify the captured request, replacing the Attacker's session ID with the Victim's session ID (which would need to be guessed or leaked), and replay the request. If successful, the Attacker would see the Victim's chat.
Mitigation Steps
1. **No User Action Required:** The vulnerability existed in the Azure cloud service and was patched server-side by Microsoft. Customer action is not required. 2. **Audit Logs:** Review Azure audit logs for any suspicious activity related to Playground sessions during the affected period. 3. **Data Handling Policies:** Reinforce internal policies against using production or sensitive data within experimental environments like the AI Studio Playground. 4. **Use API over UI:** For sensitive workflows, prefer using the Azure OpenAI API via properly authenticated service principals rather than interactive web UIs.
Patch Details
The vulnerability was patched globally by Microsoft on June 26, 2026. No specific version information is applicable as it was a server-side fix.