Close Menu
Indo Guard OnlineIndo Guard Online
  • Home
  • Cyber Security
  • Risk Management
  • Travel
  • Security News
  • Tech
  • More
    • Data Privacy
    • Data Protection
    • Global Security
What's Hot

Rare Werewolf APT uses legitimate software in attacks on hundreds of Russian enterprises

June 10, 2025

CISA adds flaws of Erlang SSH and RoundCube to famous exploited directory vulnerabilities

June 10, 2025

More than 70 organizations in several sectors aimed at Chinese Cyber ​​Spying Group

June 9, 2025
Facebook X (Twitter) Instagram
Facebook X (Twitter) Instagram YouTube
Indo Guard OnlineIndo Guard Online
Subscribe
  • Home
  • Cyber Security
  • Risk Management
  • Travel
  • Security News
  • Tech
  • More
    • Data Privacy
    • Data Protection
    • Global Security
Indo Guard OnlineIndo Guard Online
Home » Microsoft Patches Critical Copilot Studio Vulnerability Exposing Sensitive Data
Global Security

Microsoft Patches Critical Copilot Studio Vulnerability Exposing Sensitive Data

AdminBy AdminAugust 21, 2024No Comments3 Mins Read
Copilot Studio Vulnerability
Share
Facebook Twitter LinkedIn Pinterest Email Copy Link


August 21, 2024Ravi LakshmananSoftware Security / Vulnerability

Copilot Studio Vulnerability

Cybersecurity researchers have discovered a critical security flaw affecting Microsoft’s Copilot Studio that could be exploited to access sensitive information.

Tracked as CVE-2024-38206 (CVSS Score: 8.5), the vulnerability was described as a disclosure bug that results from server-side request forgery (USSR) attack.

“An authenticated attacker could bypass server-side request forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network,” Microsoft. said in a recommendation published on August 6, 2024.

Cyber ​​security

The tech giant went on to say that the vulnerability has been fixed and does not require any action from the customer.

Trusted security researcher Evan Grant, who is credited with discovering and reporting the flaw, said he was using Copilot’s ability to make external web requests.

“Combined with a useful bypass of SSRF protection, we used this flaw to gain access to Microsoft’s internal infrastructure for Copilot Studio, including the Instance Metadata Service (IMDS) and internal Cosmos DB instances,” Grant said. said.

Copilot Studio Vulnerability

In other words, the attack technique made it possible to obtain instance metadata in a Copilot chat message, using it to obtain managed identity access tokens that could then be abused to access other internal resources, including obtaining read/write access to the Cosmos DB instance .

In addition, the cybersecurity company noted that while this approach does not allow access to information about different tenants, the infrastructure that powers the Copilot Studio service is shared among tenants, potentially affecting multiple customers if there is increased access to Microsoft’s internal infrastructure. .

The disclosure is made as Tenable in detail Fixed two security vulnerabilities in Microsoft Azure Health Bot Service (CVE-2024-38109, CVSS Score: 9.1) that, if exploited, could allow a malicious actor to achieve lateral movement in client environments and gain access to sensitive patient data.

Cyber ​​security

It also follows Microsoft’s announcement that starting in October 2024, it will require all Microsoft Azure customers to enable multi-factor authentication (MFA) for their accounts as part of the Secure Future Initiative (SFI).

“The Ministry of Foreign Affairs will need to log into the Azure portal, the Microsoft Entra admin center and the Intune admin center. Enforcement will gradually be extended to all tenants worldwide,” Redmond said. said.

“Starting in early 2025, MFA sign-in to Azure CLI, Azure PowerShell, Azure mobile app, and Infrastructure as Code (IaC) tools will be phased in.”

Did you find this article interesting? Follow us Twitter  and LinkedIn to read more exclusive content we publish.





Source link

Share. Facebook Twitter Pinterest LinkedIn Tumblr Email Copy Link
Admin
  • Website

Related Posts

Rare Werewolf APT uses legitimate software in attacks on hundreds of Russian enterprises

June 10, 2025

CISA adds flaws of Erlang SSH and RoundCube to famous exploited directory vulnerabilities

June 10, 2025

More than 70 organizations in several sectors aimed at Chinese Cyber ​​Spying Group

June 9, 2025

Two different botnets exploit the vulnerability of the WAZUH server to launch attacks based on peaceful

June 9, 2025

Think what your IDP or CASB covers the shadow? These 5 risks prove differently

June 9, 2025

Openai prohibits chatgpt accounts used by Russian, Iranian and Chinese hacking groups

June 9, 2025
Add A Comment
Leave A Reply Cancel Reply

Loading poll ...
Coming Soon
Do You Like Our Website
: {{ tsp_total }}

Subscribe to Updates

Get the latest security news from Indoguardonline.com

Latest Posts

Rare Werewolf APT uses legitimate software in attacks on hundreds of Russian enterprises

June 10, 2025

CISA adds flaws of Erlang SSH and RoundCube to famous exploited directory vulnerabilities

June 10, 2025

More than 70 organizations in several sectors aimed at Chinese Cyber ​​Spying Group

June 9, 2025

Two different botnets exploit the vulnerability of the WAZUH server to launch attacks based on peaceful

June 9, 2025

Think what your IDP or CASB covers the shadow? These 5 risks prove differently

June 9, 2025

Openai prohibits chatgpt accounts used by Russian, Iranian and Chinese hacking groups

June 9, 2025

Operation malicious network supply software gets to NPM and Pypi ecosystems, focusing on millions worldwide

June 8, 2025

Extension of the malicious browser has infected 722 users across Latin America since the beginning of 2025

June 8, 2025
About Us
About Us

Provide a constantly updating feed of the latest security news and developments specific to Indonesia.

Facebook X (Twitter) Pinterest YouTube WhatsApp
Our Picks

Rare Werewolf APT uses legitimate software in attacks on hundreds of Russian enterprises

June 10, 2025

CISA adds flaws of Erlang SSH and RoundCube to famous exploited directory vulnerabilities

June 10, 2025

More than 70 organizations in several sectors aimed at Chinese Cyber ​​Spying Group

June 9, 2025
Most Popular

In Indonesia, crippling immigration ransomware breach sparks privacy crisis

July 6, 2024

Why Indonesia’s Data Breach Crisis Calls for Better Security

July 6, 2024

Indonesia’s plan to integrate 27,000 govt apps in one platform welcomed but data security concerns linger

July 6, 2024
© 2025 indoguardonline.com
  • Home
  • About us
  • Contact us
  • Privacy Policy

Type above and press Enter to search. Press Esc to cancel.