CVE-2024-38109: An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.

PriorityP259high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

1.83%

76.2th percentile

An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
microsoft	azure_health_bot	—	—
msrc	azure_health_bot	—	—

Detection & IOCsextracted from sources · hover to see the quote

·Vulnerability is fully mitigated server-side by Microsoft; no customer action or patch deployment is required. No technical exploitation details, payloads, or indicators have been publicly disclosed. ↗
·Exploit status is confirmed as neither publicly disclosed nor actively exploited at time of advisory publication, limiting available detection surface. ↗
·The vulnerability class is SSRF leading to privilege escalation in Azure Health Bot; detection efforts should focus on anomalous outbound requests originating from the Health Bot service to internal/metadata endpoints (e.g., IMDS at 169.254.169.254), but no specific IOCs or attack tooling have been published for this CVE. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vendor_msrc9.1CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.