Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Microsoft Copilot Studio SSRF

Critical

Synopsis

Tenable Research discovered an issue affecting Microsoft’s Copilot Studio on the Power Platform whereby an attacker can circumvent SSRF protections in order to access instance metadata, including the ability to request managed identity tokens, and other internal assets including apparent read/write access to internal Cosmos DB documents. This environment is shared among customers, which indicates potential for cross-tenant impact.

When creating custom Copilots in Copilot Studio (at web.powerva.microsoft.com) users can add custom topics, which feature the ability to add an advanced “HttpRequestAction” action. Normally, the http request action appears to block potentially sensitive IP addresses such as 127.0.0.1/localhost and 169.254.169.254.

This restriction can be bypassed by pointing the http request to an attacker-controlled server which responds with a 301 or 302 redirect to the otherwise blocked hosts. While this will allow an attacker to hit the instance metadata IP, requests would normally be blocked because the HttpRequestAction will include an X-Forwarded-For header by default, which are blocked in requests to Azure IMDS.

This can be circumvented by either adding a header to the request with multiple newlines (such that the X-Forwarded-For header becomes a part of the request body) or a newline and some characters (which will alter the X-Forwarded-For header such that it becomes abcX-Forwarded-For, for example).

With access to IMDS, it is possible to request a managed identity token for management.azure.com, which has access to internal resources such as the Cosmos DB at https://prdil101us-dncstore.documents.azure.com:443/ (specific domain depends on environment).

This resource cannot be accessed from outside of Azure (requests are blocked by a firewall). However, it can be accessed from within Copilot, using more HttpRequestAction requests. An attacker would have full read/write access to this resource.

MSRC confirmed this behavior and evaluated it as a Critical severity information disclosure.
 

Solution

Microsoft has pushed fixes to all affected services and regions. No customer action is required.

Disclosure Timeline

June 21, 2024 - Tenable discloses to MSRC. Automated acknowledgement from MSRC.
June 26, 2024 - MSRC confirms behavior and assigns case number.
June 26, 2024 - Tenable provides additional information.
June 26, 2024 - MSRC requests additional information. Tenable provides requested info.
July 2, 2024 - Tenable reports potential bypass.
July 8, 2024 - MSRC acknowledges.
July 18, 2024 - Tenable notices that fixes have been pushed and requests a status update from MSRC.
July 23, 2024 - MSRC states that fixes are still being rolled out.
July 31, 2024 - MSRC provides CVE information and states that they will let us know when it is scheduled for release.
August 7, 2024 - Tenable notices that MSRC publicly disclosed without proper coordination. Tenable requests information from MSRC.
August 13, 2024 - Tenable again requests information. MSRC provides lackluster response.

All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.

Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.

For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.

If you have questions or corrections about this advisory, please email [email protected]

Risk Information

CVE ID: CVE-2024-38206
Tenable Advisory ID: TRA-2024-32
Credit:
Evan Grant
Affected Products:
Microsoft Copilot Studio prior to July 31, 2024
Risk Factor:
Critical

Advisory Timeline

August 20, 2024 - Initial release.
September 12, 2024 - Corrected CVE.