SSRF in Azure OpenAI 'On Your Data' Feature Allows Access to Internal Network Resources
Overview
A Server-Side Request Forgery (SSRF) vulnerability was discovered in the 'On Your Data' feature of the Azure OpenAI Service. This feature allows users to connect their own data sources, such as Azure Blob Storage or web URLs, to ground the LLM's responses in specific information. The vulnerability arose from insufficient validation and sanitization of user-provided URLs during the data ingestion process. An attacker could provide a specially crafted URL pointing to internal Azure metadata services or other non-public endpoints within the Azure fabric, such as `169.254.169.254`. When the service attempted to fetch data from this malicious URL, it would unknowingly send a request from its own backend infrastructure. This flaw could be leveraged to access sensitive metadata, scan internal networks, or interact with internal services not intended for external exposure. The discovery was made by security researchers who demonstrated that it was possible to query the Azure Instance Metadata Service (IMDS) and retrieve temporary credentials for the underlying compute instance. This could lead to a full privilege escalation chain, potentially enabling access to other customers' data if not properly isolated within the multi-tenant architecture. Microsoft addressed the vulnerability by implementing a stricter allow-list for data source URLs and enhancing network-level egress filtering to block requests to known internal IP ranges.
Affected Systems
Testing Guide
1. **Identify Data Sources**: Review all data sources connected to your Azure OpenAI 'On Your Data' feature. 2. **Attempt Malicious URL**: Try to configure a new data source using a URL pointing to an internal service you control or a public request bin service (e.g., `http://169.254.169.254/metadata/instance`). 3. **Observe Results**: If the service successfully connects or if the request bin receives a connection attempt, your version or configuration might be vulnerable. In the patched environment, this action should be blocked with an error message indicating an invalid or disallowed URL.
Mitigation Steps
1. **Apply Patches**: Ensure your Azure services are fully updated, as Microsoft has patched this vulnerability on their backend. No user action is required for the specific fix. 2. **Network Segmentation**: For self-hosted RAG systems, implement strict egress filtering rules to prevent AI services from making requests to internal or metadata IP ranges. 3. **URL Validation**: If you build similar 'bring your own data' features, use a robust allow-list for protocols and domains. Deny-lists are often insufficient. 4. **Use Managed Identities**: Use managed identities for Azure resources with the principle of least privilege, minimizing the impact of credential exposure from services like IMDS.
Patch Details
Microsoft has patched this vulnerability on the Azure backend. All instances of the service have been updated automatically.