Technical impact
Server‑side request forgery in Azure SQL Database enables an attacker who can craft a query to trigger outbound requests to internal services. Based on the description, it is inferred that an unauthorized user could cause the database engine to send HTTP requests it normally would not, potentially accessing resources with higher‑privileged levels. This results in elevation of privilege within the network, allowing the attacker to gain unauthorized access to data or services not intended to be reachable from the database environment.
Affected Systems
The flaw is present in Microsoft Azure SQL Database. No specific version list is supplied, so any instance of Azure SQL Database that has not applied the vendor’s patch remains vulnerable. All users of the service may be impacted until the fix is deployed.
Risk and Exploitability
The CVSS base score of 10.0 indicates a critical impact, while the EPSS score is not available, suggesting no publicly known exploit but sufficient risk to warrant immediate action. Microsoft has not listed this issue in the CISA KEV catalog. Based on the description, it is inferred that exploitation would require an attacker who can submit a malicious query, causing Azure SQL Database to perform an outbound request to an internal endpoint that has higher privileges. Based on the severity, it is inferred that the vulnerability poses a significant risk to any organization using Azure SQL Database that has not applied the patch or limited outbound traffic.
