Server-Side Request Forgery (SSRF) in Azure AI Studio Dataset Import Feature
Overview
A Server-Side Request Forgery (SSRF) vulnerability was discovered in the Azure AI Studio's 'Import Dataset from URL' functionality. This feature allows users to create new datasets by providing a public URL to a data file. Researchers found that the backend service responsible for fetching the data did not properly validate or sanitize the user-provided URL. Specifically, it lacked restrictions against internal or private IP address ranges and did not block redirects. An authenticated attacker could exploit this by providing a specially crafted URL, such as `http://169.254.169.254/metadata/instance?api-version=2021-02-01`, which points to the Azure Instance Metadata Service (IMDS). The Azure AI service would then make a request to this internal endpoint on behalf of the attacker. This allowed the attacker to retrieve sensitive metadata, including temporary IAM credentials for the underlying virtual machine. With these credentials, the attacker could potentially gain further access to the Azure subscription's resources, such as storage accounts containing training data and models. The vulnerability exposed a critical flaw in how user-supplied input was handled in a trusted cloud service, bypassing network-level security controls.
Affected Systems
Testing Guide
This vulnerability was patched by Microsoft on the server side and can no longer be tested. A test prior to the patch would involve: 1. Navigating to the Azure AI Studio and creating a new dataset. 2. Selecting the 'From URL' option. 3. Providing a URL pointing to an attacker-controlled server or a known internal service like the IMDS endpoint. 4. Observing if the service makes a GET request to the provided URL.
Mitigation Steps
1. Microsoft has patched the service on the backend; no user action is required for the specific fix. 2. As a best practice, apply strict network policies to compute instances, limiting egress traffic to only known and trusted endpoints. 3. Enable and monitor Azure Defender for Cloud to detect anomalous activity, such as unusual access to the metadata service. 4. Whenever possible, use managed identities for Azure resources instead of relying on credentials that could be exfiltrated via SSRF.
Patch Details
Microsoft addressed this vulnerability server-side on June 11, 2026. All instances of Azure AI Studio are automatically protected.