SSRF Through AI Tool Calls COASP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   How can user-controlled input influence the target URL in an AI tool call?

   • AThe user's prompt is processed by the AI, which may extract a URL from the prompt and pass it as a parameter to a web-fetching tool.
   • BThe user directly modifies the server's routing table to redirect the tool call.
   • CThe user changes the AI model's weights to alter its behavior.
   • DThe user injects SQL to modify the tool's database of allowed URLs.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst discovers that an AI-powered customer support bot can be tricked into fetching internal URLs. The bot runs in a cloud environment and has access to a database containing customer PII. Which of the following is the most severe potential impact of this SSRF vulnerability?

   • AThe attacker can cause the bot to send excessive requests, leading to a denial of service.
   • BThe attacker can modify the bot's system prompt to change its behavior.
   • CThe attacker can read the source code of the AI model from the internal network.
   • DThe attacker can retrieve the cloud instance metadata, including IAM credentials, and use them to access the database.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is evaluating the risk of SSRF in an AI application. The application runs in a container with a service account that has broad permissions. The team wants to reduce the impact of SSRF. Which of the following is the most effective measure?

   • AApply the principle of least privilege to the service account, limiting its permissions to only what is necessary.
   • BUse a faster network connection to reduce response time.
   • CIncrease the logging level to capture more details.
   • DUse a stronger AI model that is less likely to be tricked.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An AI application uses a tool that fetches URLs. The tool is configured to follow redirects and uses a proxy. An attacker uses a redirect to bypass the proxy's allowlist and access an internal service. Which of the following is the most effective fix?

   • ADisable redirects in the HTTP client.
   • BIncrease the proxy's timeout to allow more time for validation.
   • CUse a different proxy that does not follow redirects.
   • DRe-validate the URL after each redirect against the allowlist and block private IPs.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is building an AI agent that needs to access both internal and external APIs. The internal APIs are on a private network, and the external APIs are on the internet. The security team must prevent SSRF while allowing both types of access. Which of the following is the most effective design?

   • AUse a single tool that blocks all private IPs, preventing access to internal APIs.
   • BUse a single tool that allows all URLs but logs them.
   • CUse two separate tools: one for internal APIs with a strict allowlist and one for external APIs with a domain allowlist and private IP blocking.
   • DUse a single tool that allows all URLs and relies on the AI model to choose safe ones.
   Reveal Solution Discussion Select an answer first