CVE-2024-38109: SSRF in Azure Health Bot

The SSRF vulnerability in Azure Health Bot poses a significant risk because it allows an authenticated attacker to craft malicious requests that appear to originate from the Health Bot service itself. This can be leveraged to access internal services and resources that are normally protected from external access. An attacker could potentially read sensitive data, modify configurations, or even execute commands on other systems within the network. The impact is amplified by the potential for lateral movement, allowing an attacker to compromise other systems after initially exploiting the Health Bot. The blast radius extends to any internal resource accessible via HTTP/HTTPS from the Health Bot’s network context.

1. Reserved2024-06-11
2. Published2024-08-13
3. Modified2025-07-10
4. EPSS updated2026-04-02

Due to the lack of a specified fixed version, immediate mitigation focuses on network segmentation and access control. Implement strict network policies to limit the Health Bot's outbound network access to only essential services. Utilize a Web Application Firewall (WAF) or proxy to filter outbound requests and block suspicious URLs or patterns indicative of SSRF attempts. Regularly review and audit the Health Bot's configuration to ensure adherence to security best practices. Consider implementing a service mesh to enforce fine-grained access control policies. After implementing these mitigations, verify functionality by attempting to access internal resources through the Health Bot and confirming that access is denied.