CVE-2025-21384: Microsoft Azure Health Bot SSRF Vulnerability

CVE-2025-21384 Overview

CVE-2025-21384 is a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot. An authenticated attacker can abuse the flaw to coerce the service into making unintended requests, enabling privilege escalation over a network. The vulnerability is tracked under CWE-918 (Server-Side Request Forgery) and CWE-693 (Protection Mechanism Failure). Microsoft published the security update on April 1, 2025, with the entry last modified on July 8, 2025.

Critical Impact

Authenticated network-based exploitation can lead to high impact on confidentiality, integrity, and availability, with privilege escalation within the Azure Health Bot service environment.

Affected Products

• Microsoft Azure Health Bot (cloud service)
• Tenants integrating Azure Health Bot via REST endpoints
• Workloads consuming Azure Health Bot scenarios and extensions

Discovery Timeline

• 2025-04-01 - CVE-2025-21384 published to NVD
• 2025-07-08 - Last updated in NVD database

Technical Details for CVE-2025-21384

Vulnerability Analysis

The flaw resides in how Azure Health Bot processes outbound requests on behalf of authenticated callers. An attacker with valid credentials can submit crafted input that the service uses to construct an HTTP request to an attacker-chosen destination. Because the request originates from the Azure Health Bot backend, it inherits trust boundaries the caller does not normally possess.

This trust differential is what converts a request-forging primitive into a privilege escalation. The service can reach internal endpoints, instance metadata, or peer services that are unreachable from the public network. The CWE-693 mapping indicates that protection mechanisms intended to constrain outbound destinations failed to enforce the intended policy.

The attack vector is Network with Low attack complexity. No user interaction is required, and the attacker only needs Low privileges, typically a standard authenticated tenant role.

Root Cause

The root cause is insufficient validation of user-controllable URLs or hostnames that the Azure Health Bot service dereferences server-side. Allow-list, scheme, and destination checks did not prevent requests targeting internal address space or sensitive control-plane endpoints. Microsoft addressed the issue in the service backend; no customer-side patch deployment is required.

Attack Vector

An authenticated attacker issues an API request containing a crafted URL, webhook target, connector destination, or scenario element that Azure Health Bot fetches. The backend resolves the supplied host and performs the outbound request with its own service identity. The attacker observes responses, side effects, or token material returned through the bot pipeline. This grants access to resources outside the attacker's authorized scope.

No verified proof-of-concept code is publicly available. The EPSS probability is 1.451% with a percentile of 81.116, indicating elevated relative likelihood of exploitation interest despite no confirmed in-the-wild activity.

Detection Methods for CVE-2025-21384

Indicators of Compromise

• Unexpected outbound requests from Azure Health Bot service identities to internal IP ranges, link-local addresses such as 169.254.169.254, or non-business domains.
• Anomalous Azure Health Bot scenario edits or connector configurations referencing raw IP addresses, alternate ports, or URL-encoded hosts.
• Spikes in 4xx/5xx responses on Health Bot management APIs paired with successful authentication events from atypical source IPs.

Detection Strategies

• Review Azure activity logs for Microsoft.HealthBot resource operations performed by accounts that do not normally manage bot scenarios.
• Correlate Azure AD sign-ins against Health Bot administrative actions to surface compromised low-privilege identities.
• Inspect bot telemetry for outbound HTTP calls whose destinations do not match documented integrations or scenario templates.

Monitoring Recommendations

• Forward Azure Health Bot diagnostic logs and Azure AD audit logs to a centralized analytics platform for retention and correlation.
• Alert on creation or modification of webhook URLs, custom connectors, and scenario actions that contain private or metadata-service hostnames.
• Baseline expected outbound destinations for each Health Bot instance and alert on deviations.

How to Mitigate CVE-2025-21384

Immediate Actions Required

• Confirm that the Microsoft-managed fix has been applied to your Azure Health Bot tenant by reviewing the Microsoft Security Update CVE-2025-21384 advisory.
• Audit accounts with access to Azure Health Bot management and remove standing privileges no longer required.
• Rotate any secrets, API keys, or tokens that were configured in Health Bot scenarios prior to the fix.

Patch Information

Microsoft remediated CVE-2025-21384 in the Azure Health Bot cloud service. Because the product is a managed service, customers do not need to install a binary patch. Validate fix status and any required configuration changes through the Microsoft Security Response Center advisory.

Workarounds

• Restrict Health Bot administrative roles to a minimal set of identities and enforce multi-factor authentication on those accounts.
• Constrain outbound integrations to vetted domains and remove unused connectors or webhook targets.
• Enable conditional access policies that limit Azure Health Bot management plane access to trusted networks and compliant devices.

# Example: list Azure Health Bot resources and role assignments for review
az resource list --resource-type Microsoft.HealthBot/healthBots -o table
az role assignment list \
  --scope /subscriptions/<SUB_ID>/resourceGroups/<RG>/providers/Microsoft.HealthBot/healthBots/<BOT_NAME> \
  -o table