Microsoft Purview Informationsfreigabeschwächung

The SSRF vulnerability in Microsoft Purview allows an attacker who has authenticated access to the system to craft malicious requests that the application will execute on the server's behalf. This can lead to the disclosure of sensitive internal resources, such as configuration files, database credentials, or internal APIs. An attacker could potentially scan internal networks for open ports and services, or even interact with internal systems that are not directly exposed to the internet. The blast radius extends to any internal resources accessible from the Purview server, potentially compromising sensitive data and impacting internal operations. While not directly exploitable for remote code execution, the information gained through SSRF can be a stepping stone for further attacks.

Organizations heavily reliant on Microsoft Purview for data governance and compliance are at risk. Specifically, deployments with less stringent network security controls or those using older, unpatched versions of Purview are more vulnerable. Shared hosting environments where multiple tenants share the same infrastructure could also be affected if proper isolation measures are not in place.

• dotnet / server:

Get-Process -Name "Microsoft.Purview.Service" | Select-Object ProcessId, CPU, WorkingSet

• generic web:

curl -I <purview_endpoint> | grep -i 'Server'

1. 2025-01-09Disclosure

   disclosure

1. Reserviert2024-12-11
2. Veröffentlicht2025-01-09
3. Geändert2026-02-13
4. EPSS aktualisiert2026-04-02

Until a patch is available, several mitigation strategies can be employed. First, restrict the network access of the Microsoft Purview server to only the necessary resources. Implement strict input validation to prevent attackers from manipulating the application's requests. Consider using a Web Application Firewall (WAF) to filter out malicious requests and block SSRF attempts. Regularly review and update firewall rules to reflect the current threat landscape. Implement network segmentation to isolate sensitive internal resources. Monitor network traffic for unusual outbound requests originating from the Purview server.