CVE-2025-21385: SSRF in Microsoft Purview

The SSRF vulnerability in Microsoft Purview allows an attacker who has authenticated access to the system to craft malicious requests that the application will execute on the server's behalf. This can lead to the disclosure of sensitive internal resources, such as configuration files, database credentials, or internal APIs. An attacker could potentially scan internal networks for open ports and services, or even interact with internal systems that are not directly exposed to the internet. The blast radius extends to any internal resources accessible from the Purview server, potentially compromising sensitive data and impacting internal operations. While not directly exploitable for remote code execution, the information gained through SSRF can be a stepping stone for further attacks.

1. Reserved2024-12-11
2. Published2025-01-09
3. Modified2026-02-13
4. EPSS updated2026-04-02

Until a patch is available, several mitigation strategies can be employed. First, restrict the network access of the Microsoft Purview server to only the necessary resources. Implement strict input validation to prevent attackers from manipulating the application's requests. Consider using a Web Application Firewall (WAF) to filter out malicious requests and block SSRF attempts. Regularly review and update firewall rules to reflect the current threat landscape. Implement network segmentation to isolate sensitive internal resources. Monitor network traffic for unusual outbound requests originating from the Purview server.