SSRF in Azure AI Studio Custom Data Connectors Leads to Cross-Tenant Metadata Service Access
Overview
Security researchers from Wiz discovered a critical Server-Side Request Forgery (SSRF) vulnerability in the Azure AI Studio's "Bring Your Own Data" feature. This feature allows users to connect their AI applications to various data sources, including public URLs. The vulnerability existed in the backend service that processes these custom data URLs. By providing a specially crafted URL pointing to internal Azure metadata endpoints, an attacker could force the service to make requests on their behalf from its privileged network position. The most severe impact of this was the ability to access the Azure Instance Metadata Service (IMDS). Researchers demonstrated that by crafting a specific URL, they could trick the service into requesting and returning authentication tokens for other Azure services belonging to different tenants that were being processed on the same shared infrastructure. This effectively broke tenant isolation, allowing an attacker to gain read access to other customers' AI Studio resources, including data sources, models, and endpoint configurations. The root cause was insufficient validation and sanitization of user-provided URLs in the data ingestion service, failing to block access to internal IP ranges and metadata services. Microsoft has since patched the service.
Affected Systems
Testing Guide
1. This vulnerability was in the Azure backend and has been patched, so it cannot be directly tested by users anymore. 2. To test for similar vulnerabilities in your own applications, try to add a data source using an internal IP address or a cloud metadata service endpoint (e.g., `http://169.254.169.254/`). 3. Observe if the application successfully fetches data from the internal endpoint or returns an error. A successful connection indicates a potential SSRF vulnerability.
Mitigation Steps
1. No user action is required as Microsoft has patched the backend service globally. 2. As a best practice, always apply the principle of least privilege to data sources connected to AI services. Use private endpoints where possible. 3. Regularly audit access logs for your cloud resources to detect anomalous request patterns. 4. When building similar systems, ensure stringent URL validation, implement egress firewalls, and deny access to all internal and metadata IP addresses.
Patch Details
Microsoft deployed a global server-side patch that strengthens URL validation and blocks requests to internal metadata services and private IP ranges.