Microsoft 365 Copilot Flaw Lets Hackers Steal Sensitive Data via Indirect Prompt Injection
A vulnerability was identified in Microsoft 365 Copilot, which allowed malicious actors to manipulate the AI assistant to retrieve and exfiltrate sensitive tenant data through a document.
A vulnerability was identified in Microsoft 365 Copilot, which allowed malicious actors to manipulate the AI assistant to retrieve and exfiltrate sensitive tenant data through a document.
The mechanism involved encoding the data into a malicious Mermaid diagram, which, upon interaction, redirected the data to an attacker's server.
The issue arose when Microsoft 365 Copilot was tasked with summarizing a specially crafted Office document. This document contained an indirect prompt injection payload, leading the AI to perform unauthorized actions as reported by researchers.
Instead of generating a typical summary, the AI retrieved recent corporate emails, encoded them in hexadecimal, and used this data to construct a deceptive “Login” button rendered as a Mermaid diagram.
This diagram included CSS and a hyperlink embedding encoded data, which redirected to an attacker's server upon user interaction.
The mechanism involved encoding the data into a malicious Mermaid diagram, which, upon interaction, redirected the data to an attacker's server.
Mermaid is a visualization tool that creates diagrams from simple text inputs. It supports various diagram types and allows CSS styling, which can be exploited to embed malicious links.
In this scenario, the attacker exploited Copilot’s built-in search functionality to extract the victim's recent emails. The AI then encoded this information into a hex string, formatted it appropriately for the Mermaid renderer, and inserted it into a clickable “Login” node. This node contained a hyperlink pointing to a private server.
A[Malicious Document] -->|User asks to summarize| B[Indirect Prompt Injection]
Clicking this button triggered a hidden iframe, briefly displaying an HTTP response from the attacker's server before disappearing. This added a layer of deception, making the process appear legitimate.
Microsoft addressed this vulnerability by disabling interactive elements, such as hyperlinks, within Mermaid diagrams in Copilot. This update mitigates the risk of data exfiltration. Users are advised to update their Copilot integrations and avoid summarizing untrusted documents until the patch is applied.
Based on reporting by GBHackers.