# Microsoft Copilot Studio Flaw Leaks Sensitive Cloud Data! 🔓

**URL:** <https://onehack.st/t/microsoft-copilot-studio-flaw-leaks-sensitive-cloud-data/289570>\
**Category:** News & Articles\
**Tags:** hacking, cloud-storage\
**Created:** [August 22, 2024, 3:16am UTC](https://onehack.st/t/microsoft-copilot-studio-flaw-leaks-sensitive-cloud-data/289570 "2024-08-22T03:16:40Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheJoker](https://onehack.st/user_avatar/onehack.st/thejoker/32/22660_2.png) [@TheJoker](https://onehack.st/u/TheJoker)\
**Post date:** [August 22, 2024, 3:16am UTC](https://onehack.st/t/microsoft-copilot-studio-flaw-leaks-sensitive-cloud-data/289570/1 "2024-08-22T03:16:40Z")

</div>

**Summary:**

1. **Vulnerability Discovered**  
A server-side request forgery (SSRF) flaw in Microsoft’s Copilot Studio tool allowed researchers to access sensitive internal cloud data. This issue, tracked as CVE-2024-38206, involved exploiting the tool to bypass SSRF protections.

2. **Impact on Cloud Services**  
The exploit enabled unauthorized access to internal services, including Microsoft’s Instance Metadata Service and Cosmos DB. The flaw potentially affected multiple tenants due to shared infrastructure.

3. **Mitigation and Response**  
Microsoft quickly addressed the vulnerability, and the issue has been fully mitigated. No user action was required to secure Copilot Studio.

**Read more at:** [Dark Reading](https://darkreading.com)