CVE-2025-21385
📋 TL;DR
This Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows authenticated attackers to make the application send requests to internal systems, potentially exposing sensitive data or services. Organizations using Microsoft Purview are affected, particularly those with internet-facing instances or insufficient network segmentation.
💻 Affected Systems
- Microsoft Purview
📦 What is this software?
Purview by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Attacker accesses internal services, exfiltrates sensitive data, or performs lateral movement to critical systems.
Likely Case
Information disclosure from internal APIs, metadata services, or cloud instance metadata endpoints.
If Mitigated
Limited impact due to network segmentation, egress filtering, and proper authentication controls.
🎯 Exploit Status
Exploitation requires understanding of Purview's API endpoints and internal network layout.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update Guide for specific patch versions
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21385
Restart Required: No
Instructions:
1. Review Microsoft Security Update Guide for CVE-2025-21385. 2. Apply the latest security updates for Microsoft Purview. 3. Verify update installation through Purview admin portal.
🔧 Temporary Workarounds
Network Segmentation
allRestrict Purview server's outbound network access to only necessary endpoints
Input Validation
allImplement strict validation on all URL/endpoint parameters in Purview configurations
🧯 If You Can't Patch
- Implement network egress filtering to block Purview servers from accessing internal services
- Enable audit logging for all Purview API calls and monitor for unusual request patterns
🔍 How to Verify
Check if Vulnerable:
Check Purview version against patched versions in Microsoft advisoryCheck Version:
Get-PurviewVersion (PowerShell) or check Purview admin portalVerify Fix Applied:
Verify patch installation through Purview admin portal or version check commands📡 Detection & Monitoring
Log Indicators:
- Unusual outbound requests from Purview servers
- SSRF patterns in application logs
- Failed authentication attempts followed by internal requests
Network Indicators:
- Purview servers making requests to internal IP ranges
- Unexpected traffic to metadata services (169.254.169.254)
SIEM Query:
source="purview" AND (url_contains="internal" OR dest_ip=private_range) AND user_agent="Purview"