SSRF in Azure OpenAI "On Your Data" Feature Exposes Internal Metadata Services
Overview
Security firm Wiz.io disclosed a Server-Side Request Forgery (SSRF) vulnerability in the Azure OpenAI Service's "On Your Data" feature. This feature allows users to connect their own data sources, such as Azure Blob Storage, to a chat model. The vulnerability stemmed from insufficient validation of URLs provided as data sources during the ingestion process. An attacker could provide a specially crafted URL pointing to internal Azure network endpoints, most notably the Instance Metadata Service (IMDS) endpoint at `169.254.169.254`. When the Azure service attempted to fetch data from this malicious URL, it would instead make a request to the IMDS. By manipulating the path of the URL, the attacker could access sensitive information from the metadata service, including temporary access tokens, service principal credentials, and other environment details for the underlying virtual machine hosting the Azure OpenAI service. This could allow an attacker to pivot and gain unauthorized access to other Azure resources within the victim's tenant. The vulnerability was exploitable by any user with permissions to configure data sources for Azure OpenAI. Microsoft's security team acknowledged the issue and deployed a fix that enforces stricter URL validation and network egress rules for the data ingestion service, preventing it from reaching internal IP addresses.
Affected Systems
Testing Guide
1. **Review Historical Logs**: Check Azure Monitor and Activity Logs for the period prior to the patch (November 2025) for any outbound connections from the Azure OpenAI service to unusual IP addresses, especially `169.254.169.254`. 2. **Attempt to Reproduce (Post-Patch)**: In your Azure OpenAI Studio, attempt to add a new data source using the URL `http://169.254.169.254/metadata/instance?api-version=2021-02-01`. The connection attempt should now fail with a validation or network error, confirming the patch is effective.
Mitigation Steps
1. **No User Action Required for Patch**: Microsoft has patched the vulnerability on the service side. All customers are protected automatically. 2. **Review Access Controls**: As a best practice, review and apply the principle of least privilege to roles that can configure data sources in Azure OpenAI. Limit these permissions to only trusted administrators. 3. **Monitor Audit Logs**: Regularly monitor Azure audit logs for any suspicious configuration changes or data source additions to your Azure OpenAI instances. 4. **Use Private Endpoints**: For connecting to your data sources, use Azure Private Endpoints where possible. This ensures that traffic between the Azure OpenAI service and your data remains on the Microsoft backbone network and is not exposed to the public internet, reducing the attack surface.
Patch Details
Microsoft deployed a server-side patch in December 2025. No customer action is required.