SSRF Through AI Tool Calls COASP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An AI assistant is integrated with a tool that fetches URLs. The tool uses a proxy that resolves DNS and makes the request. An attacker exploits SSRF to access an internal service. The security team wants to implement a fix that is both effective and has minimal operational impact. Which of the following is the best option?

   • AModify the proxy to validate the resolved IP address against an allowlist and block private ranges before making the request.
   • BDisable the fetch tool and use a different method to obtain the data.
   • CAdd a firewall rule to block all traffic from the AI server to internal IPs.
   • DChange the AI model's system prompt to instruct it not to fetch internal URLs.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A penetration tester is assessing an AI application that fetches URLs. The tester successfully retrieves the contents of an internal configuration file via SSRF. Which of the following is the most appropriate next step to determine the full impact?

   • AImmediately report the vulnerability and stop testing.
   • BAttempt to access other internal services and the cloud metadata endpoint to identify sensitive data and credentials.
   • CVerify that the application logs all SSRF attempts.
   • DCheck if the AI model can be retrained to avoid fetching internal URLs.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company deploys an AI assistant that can fetch web pages on behalf of users to summarize articles. The assistant receives a user prompt and passes the URL directly to a server-side HTTP client. An attacker submits a prompt asking the assistant to fetch 'http://169.254.169.254/latest/meta-data/'. Which of the following best describes why this attack succeeds?

   • AThe AI model itself is vulnerable to prompt injection that alters its system prompt.
   • BThe HTTP client is configured to use a proxy that resolves internal hostnames.
   • CThe server-side HTTP client follows the URL supplied by the user without validating the target against an allowlist.
   • DThe AI model has been trained on internal network data and can predict internal IP addresses.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following best describes the risk of SSRF in an AI system that can access internal network services?

   • AIt only allows the attacker to access public websites.
   • BIt has no impact because AI systems are isolated from internal networks.
   • CIt only affects the AI model's performance, not security.
   • DIt allows an attacker to use the AI system as a proxy to scan and attack internal network services.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization is building an AI agent that can access internal tools via HTTP APIs. The agent is deployed in a Kubernetes cluster. Which of the following is the most effective way to prevent SSRF while allowing the agent to call only approved internal APIs?

   • AImplement a proxy that logs all API calls.
   • BUse a NetworkPolicy that allows egress only to the IP addresses of the approved APIs.
   • CUse mutual TLS authentication for all API calls.
   • DRely on the AI model's instruction to only call approved APIs.
   Reveal Solution Discussion Select an answer first