Publicly Exposed Azure AI Managed Endpoints Due to Insecure Default Network Configuration
Overview
A security audit revealed that Managed Online Endpoints created through the Azure AI Studio UI were, by default, publicly accessible from the internet, even when deployed within a workspace associated with a Virtual Network (VNet). The vulnerability was not a software flaw but a critical insecure default configuration. Developers creating these endpoints for model inference assumed that deploying within a VNet-locked workspace would automatically restrict network access to that VNet. However, the default setting for 'Public network access' was 'Enabled', and this setting overrode the workspace-level network isolation. While the scoring URI for each endpoint is a long, randomized URL, these URLs were discoverable through internet-wide scanning or could be leaked through logs and other means. This misconfiguration allowed any unauthorized party on the internet to send inference requests to the exposed models. The impact included significant financial costs from unauthorized GPU consumption ('inference-jacking') and potential data exfiltration if the models were designed to process sensitive or personally identifiable information as input. Microsoft has since addressed the issue by updating the UI to make the network settings more explicit and changing the default behavior for new endpoints created in VNet-enabled workspaces.
Affected Systems
Testing Guide
1. **Locate Endpoint URI**: In the Azure AI Studio, navigate to your endpoint's 'Details' tab and copy the 'Scoring URI'. 2. **Test from External Network**: From a machine outside of your Azure VNet (e.g., your local machine), attempt to make a request to the URI using a tool like `curl`. For example: `curl -X POST <your-scoring-uri> -H 'Authorization: Bearer <your-key>' -H 'Content-Type: application/json' -d '{}'`. 3. **Check Response**: If you receive a successful (e.g., 200 OK) or authentication-related error (e.g., 401 Unauthorized), the endpoint is publicly accessible. If you receive a connection timeout or a DNS resolution error, it is likely properly firewalled.
Mitigation Steps
1. **Audit Existing Endpoints**: Immediately review the 'Networking' tab for all Managed Online Endpoints in Azure AI Studio or Azure Machine Learning workspace. 2. **Disable Public Access**: For any endpoint that should be private, disable the 'Public network access' setting. 3. **Implement Private Endpoints**: For secure access from within your VNet, configure a Private Endpoint for the Azure ML workspace. This ensures all traffic to the endpoints stays on the Azure backbone network. 4. **Use Azure Policy**: Implement Azure Policy to audit for or deny the creation of ML endpoints with public network access enabled.
Patch Details
Microsoft updated the Azure AI Studio UI in Q4 2025 to make the public access setting more prominent during endpoint creation and changed the default for VNet-associated workspaces to 'Disabled'.