SSRF flaw CVE-2024-38206 let attackers reach internal Copilot Studio hosts

CVE-2024-38206 is a server-side request forgery (SSRF) vulnerability in Microsoft Copilot Studio that let an authenticated attacker bypass the product's SSRF protections to leak sensitive information over a network.

Microsoft's advisory for the flaw carries a revision date of August 6, 2024, the same period in which security researchers published technical details of the exploit.

What happened

Tenable researchers discovered the server-side request forgery flaw in the chatbot creation tool, which they exploited to access Microsoft's internal infrastructure, including the Instance Metadata Service and internal Cosmos DB instances.

The weakness was classified as CWE-918, Server-Side Request Forgery, and Microsoft assigned itself as the CNA that confirmed the issue.

Impact

A server-side request forgery bug in Microsoft's tool for creating custom AI chatbots potentially exposed info across multiple tenants within cloud environments.

Because the Copilot Studio infrastructure the researchers reached was shared among tenants, the Tenable researcher said the risk from any impact was magnified.

Microsoft's own scoring of the flaw describes its confidentiality impact as total loss of confidentiality, with all resources within the impacted component divulged to the attacker.

Response

Microsoft responded quickly to Tenable's notification of the flaw, and it has since been fully mitigated, with no action required on the part of Copilot Studio users, the company said in its security advisory.

Microsoft's advisory states that the vulnerability has already been fully mitigated and that there is no action for users of this service to take.

Lessons for security leaders

This case shows why low-code AI builders that let business users wire chatbots to external HTTP endpoints deserve the same egress controls as any cloud workload with network access. Security teams running SaaS copilots should ask vendors whether request-building features can reach instance metadata services, internal databases, or other hosts on the surrounding subnet, and whether that infrastructure is shared across customers. Treating an authenticated, low-privilege user as a potential SSRF source, not just an anonymous external attacker, is a useful baseline when reviewing AI assistant platforms that accept arbitrary outbound requests.