2024-08-06 · 2024-Q3
Microsoft Copilot Studio SSRF
Layer tags: not yet tagged.
Target
Microsoft Copilot Studio
Impact
Access to Microsoft internal infrastructure, IMDS, and internal Cosmos DB; cross-tenant impact possible
Root Cause
Server-Side Request Forgery via HTTP header manipulation and redirect techniques