Microsoft Copilot Studio SSRF

Tenable Research discovered an issue affecting Microsoft’s Copilot Studio on the Power Platform whereby an attacker can circumvent SSRF protections in order to access instance metadata, including the ability to request managed identity tokens, and other internal assets including apparent read/write access to internal Cosmos DB documents. This environment is shared among customers, which indicates potential for cross-tenant impact.

When creating custom Copilots in Copilot Studio (at web.powerva.microsoft.com) users can add custom topics, which feature the ability to add an advanced “HttpRequestAction” action. Normally, the http request action appears to block potentially sensitive IP addresses such as 127.0.0.1/localhost and 169.254.169.254.

This restriction can be bypassed by pointing the http request to an attacker-controlled server which responds with a 301 or 302 redirect to the otherwise blocked hosts. While this will allow an attacker to hit the instance metadata IP, requests would normally be blocked because the HttpRequestAction will include an X-Forwarded-For header by default, which are blocked in requests to Azure IMDS.

This can be circumvented by either adding a header to the request with multiple newlines (such that the X-Forwarded-For header becomes a part of the request body) or a newline and some characters (which will alter the X-Forwarded-For header such that it becomes abcX-Forwarded-For, for example).

With access to IMDS, it is possible to request a managed identity token for management.azure.com, which has access to internal resources such as the Cosmos DB at https://prdil101us-dncstore.documents.azure.com:443/ (specific domain depends on environment).

This resource cannot be accessed from outside of Azure (requests are blocked by a firewall). However, it can be accessed from within Copilot, using more HttpRequestAction requests. An attacker would have full read/write access to this resource.

MSRC confirmed this behavior and evaluated it as a Critical severity information disclosure.