Critical SSRF Flaw Discovered in Azure Storage Resource Provider
On May 8, 2025, Microsoft disclosed a critical vulnerability identified as CVE-2025-29972, impacting the Azure Storage Resource Provider (SRP). This vulnerability allows authenticated attackers to perform Server-Side Request Forgery (SSRF) across the network, potentially enabling spoofing attacks in affected cloud environments.
What is SSRF?
Server-Side Request Forgery (SSRF) is a security flaw where an attacker can force a server to make HTTP requests to internal or external systems on their behalf. This can lead to unauthorized access to sensitive services, token leaks, or privilege escalation, especially in cloud environments with metadata endpoints or internal APIs.
Technical Details
The vulnerability resides in Azure’s SRP service and arises when an authenticated user sends specially crafted network requests that trick the service into sending spoofed responses or requests. Although the user must be authorized, no user interaction is required, and the attack can be performed remotely.
The vulnerability is categorized under CWE-918: Server-Side Request Forgery (SSRF).
CVSS v3.1 Score
The issue has been assigned a CVSS v3.1 base score of 9.9 (CRITICAL) with the following vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
This score reflects:
- Attack Vector: Network – remotely exploitable
- Attack Complexity: Low – requires no specialized conditions
- Privileges Required: Low – attacker must be authenticated
- User Interaction: None
- Scope: Changed – impacts components beyond the vulnerable one
- Impact on Confidentiality, Integrity, and Availability: High
Affected Systems
The Azure Storage Resource Provider is a component within the Azure ecosystem that manages and orchestrates storage resources such as blobs, files, and queues. While specific version identifiers were not disclosed, Microsoft has confirmed the issue affects the SRP service in its hosted environments.
Mitigation
Microsoft has issued guidance and mitigation steps via its security advisory. Cloud administrators should:
- Review the official Microsoft advisory
- Apply available patches or configuration changes
- Restrict overly permissive user roles
- Monitor access logs for unusual internal network requests
References
Conclusion
CVE-2025-29972 presents a critical risk in Microsoft Azure environments due to the nature of SSRF vulnerabilities. Although exploitation requires authentication, the low complexity and high impact make immediate action essential. Organizations should take swift steps to validate protections and follow vendor recommendations.