Document validated Azure high-impact permission abuse

[carlospolop]

Summary

• integrate each Azure attack into the existing service-specific privilege-escalation hierarchy
• document only concrete, validated escalation, credential theft, code execution, sensitive-data, injection, and lateral-movement paths behind AzurePEASS high/critical findings
• distinguish standalone permissions from required combinations and configuration-dependent attacks

Documentation structure

Existing Entra ID, Conditional Access, API Management, Automation, Batch, Container Apps, Container Registry, Functions, Key Vault, Service Bus, Static Web Apps, Storage, and VM pages are extended in place. Services that had no privilege-escalation page receive narrowly scoped ARM Deployment, App Configuration, Communication Services, Data Factory, Event Grid, Event Hubs, IoT Hub, Kubernetes, Log Analytics, Notification Hubs, Redis, Relay, and SignalR/Web PubSub pages, all registered in SUMMARY.md. There is no catch-all high-impact-permissions page.

Live validation

Validated in an authorized Azure subscription with disposable entities/resources:

• Graph: application credential takeover, self app-role grant, tenant-wide delegated grant, directory-role assignment, Conditional Access modification with its required scope pair, and Temporary Access Pass creation
• ARM/data plane: Automation, Batch, Event Hubs, Data Factory and API Management credential retrieval; AKS admin/user kubeconfigs; VM managed Run Command as root; and Key Vault template-deployment secret exfiltration
• Additional proofs: App Configuration read-write connection-string access, Event Grid forged-event publication, IoT Hub device-registry control, Log Analytics HMAC-authenticated log injection, and blob reads using both account and service SAS tokens minted through ARM
• Tested-only messaging batch: returned and regenerated SignalR/Web PubSub keys produced authenticated broadcasts; Communication Services keys minted Chat/VoIP identities and tokens; Notification Hubs namespace/hub keys enumerated registration feeds; Relay namespace, Hybrid Connection, and WCF keys authenticated to their data planes
• Search: listed and newly created query keys read a seeded search document; a regenerated admin key uploaded a new document
• Cosmos DB: both the POST-backed readonlykeys/action and GET-backed readonlykeys/read returned account-wide read-only master keys that read a seeded document; a write attempt with the key was rejected
• Logic Apps: current-version and immutable-version trigger callback URLs both invoked the canary workflow; direct trigger execution and trigger-history resubmission each created a new successful run
• Data Factory: pipelines/createRun/action started a stored pipeline, which invoked the signed Logic workflow and returned its canary
• DPS: both service-level and policy-specific list-key actions returned reusable provisioningserviceowner credentials; each credential created a disposable enrollment through the data plane
• Container Apps: Job start/action executed an overridden image and shell command without changing the stored Job; Job and Dapr-component list-secret actions returned exact seeded inline-secret canaries
• Compute: managed-disk, snapshot, and child disk-restore-point beginGetAccess actions each issued a read SAS that recovered an exact seeded byte range from the raw VHD; every SAS was revoked
• Functions: functions/masterkey/read returned a master key and invoked a protected function when the app used file-backed secret storage; functions/token/read returned a short-lived admin JWT that listed a function key, invoked the protected function, accessed host status, and performed an administrative function invocation
• Function slots: slots/config/list/action disclosed a seeded secret and a reusable Storage connection string whose account key independently uploaded and downloaded the blob canary; slots/publishxml/action returned slot publishing credentials that deployed and invoked a canary through Kudu when SCM basic authentication was enabled, while the same credentials correctly failed with HTTP 401 when it was disabled
• Event Grid callback disclosure: all five generic, custom-topic, system-topic, domain, and domain-topic getFullUrl/action variants returned complete signed Logic App endpoints; every recovered URL invoked the workflow and returned its distinct seeded canary
• Container Registry: registries/runs/listLogSasUrl/action returned a signed run-log URL that downloaded the exact ACR Tasks build-log canary without task creation or scheduling rights
• Untested GCCM and Relay disaster-recovery look-alikes were deliberately excluded; Logic root callback/key regeneration and Cosmos key regeneration were also excluded because their standalone operations did not yield a proven access or escalation path
• Failed candidates were excluded: Static Web App resetapikey/action and Web App newpassword/action returned no credential; Logic access-key routes were deprecated; App Insights token candidates and Function host-runtime master routes did not resolve; App Service connection-string candidate routes returned HTTP 405; Web PubSub data-token testing could not be authorized; DPS enrollment write via Entra authentication, restore-point retrieveSasUris, ordinary managed-disk write SAS, and Job-start secret-reference injection did not produce standalone validated attacks
• Redis creation was unavailable because new legacy Azure Cache for Redis deployment is blocked during retirement; hybrid/Arc variants require external connected infrastructure and are documented from their equivalent API contracts

All disposable applications, service principals, users, grants, policies, role artifacts, resources, canary data, resource groups, SDK directories, and local test files were removed and re-queried after cleanup.

Validation

• mdbook build
• focused Azure tests: 41 passed, 83 subtests passed
• disposable Azure integration test: 1 passed
• complete CloudPEASS suite after incorporating the concurrent Kubernetes baseline update: 306 passed, 1 skipped, 168 subtests passed
• verified every newly added tested permission string has the expected severity and an exact HackTricks documentation occurrence

Additional live-validated credential surfaces (2026-09-08)

• Static Web Apps deployment token deployed a canary site; Cognitive Services account keys called the Language API.
• Azure ML workspace listKeys and listStorageAccountKeys recovered a linked Storage key and downloaded a protected blob; workspace datastore and connection secrets independently accessed their seeded Storage/Language targets.
• Foundry account- and project-scoped connection listsecrets actions each returned a reusable Cognitive Services key that successfully called the connected Language endpoint.
• Function host, function-key, and file-backed function-secret operations invoked a protected function. Blob-backed listsecrets explicitly failed and is documented as configuration-dependent.
• Logic Integration Account root, schema, map, partner, assembly, and agreement callback actions returned signed URLs that fetched exact artifact canaries without Entra authentication. Workflow-wide listCallbackUrl supplied a wildcard signature that invoked a known trigger path.
• Azure Maps account keys authenticated to the Timezone API. A Bot Service Direct Line channel secret minted a token and started a conversation.
• API Management subscription keys changed a gateway request from 401 to 200; a secret Named Value was recovered exactly; ordinary backend read exposed a literal Function master key that invoked the protected function; OAuth and OIDC list-secret actions returned their exact stored client secrets when test-console use was enabled.
• Earlier Consumption-tier APIM identity-provider/tenant attempts, Basic Fluid Relay creation, and the initial Quantum provider attempt were tier/configuration failures; later supported-tier tests succeeded and are documented below. APIM backend listSecrets, portal settings, preview client applications, API-connection keys, Health Bot delegated data actions, Maps UAMI SAS, and Logic agreement listSecrets remain excluded.
• Generic unknown listKeys/listSecrets-looking Azure operations are no longer automatically Critical. They remain Medium until exact reuse or secret impact is validated; known proven rules retain explicit High/Critical tiers.
• Bot Service and Maps received their own privilege-escalation pages and all other findings were added to their existing API Management, AI Foundry, Functions, Logic Apps, and Static Web Apps pages.

Latest validation: 343 passed, 1 skipped, 200 subtests passed; mdbook build succeeded. A real macOS/zsh AzurePEASS run against the authorized subscription completed using the Azure CLI session. Cleanup was re-queried: the resource group, Entra app/SP, soft-deleted Key Vault/Cognitive resources, temporary artifacts, test-only extensions/image, and test-only provider registrations are absent.

Additional live validation (second 2026-09-08 pass)

• Azure Monitor action-group read and Application Insights web-test read each returned an exact signed Logic Apps callback; the unsigned endpoint failed and each recovered URI invoked the protected canary. Both resources remained disabled.
• ACR webhook getCallbackConfig returned the exact signed callback from a disabled Basic webhook and that callback invoked the canary.
• API Management service, API, operation, and product policy reads independently returned a literal planted credential that invoked the canary.
• VPN Server Configuration listAllRadiusServersSecrets returned the exact planted RADIUS secret while ordinary resource reads redacted it; no VPN gateway was deployed.
• App Configuration ListKeyValue and keyValues/read independently returned the exact seeded sensitive value from a Free store.
• Current Bot OAuth listWithSecrets returned an empty secret for both CLI and direct ARM-created SingleTenant connections, so it was excluded. App Service backup-secret validation was blocked before plan creation by the subscription hard compute quota of zero, so it was also excluded.
• Removed unvalidated TODO lists from Azure privilege-escalation pages rather than presenting operation names as attacks.
• Complete CloudPEASS validation: 346 passed, 1 skipped, 210 subtests passed. A fresh real macOS/zsh AzurePEASS run completed against the authorized subscription in 7.1 seconds. mdbook build succeeded.
• Cleanup was re-audited after deletion: no matching active resources/groups, soft-deleted Key Vault/App Configuration/APIM/Cognitive objects, Entra apps/service principals, temporary files, or test-installed extension remain. The audit also found and purged three older azpeass APIM soft-delete remnants.

Additional live validation (third 2026-09-08 pass)

• Service Bus namespace, queue, and topic authorization-rule list/renew operations were each validated: every returned or replacement SAS key sent a message, and the entity keys also recovered the exact queued/subscribed canaries.
• Event Hubs namespace and entity authorization-rule list/renew operations each returned usable keys; all four paths injected a data-plane event with HTTP 201.
• ACR regenerateCredential returned a changed admin password that exchanged for a registry bearer token and authenticated to the catalog.
• App Configuration RegenerateKey returned a new read-write connection string that recovered the seeded secret after propagation.
• Search listAdminKeys created an index, uploaded a document, and queried the exact canary. Cosmos DB listKeys signed direct REST requests that created and read a seeded document.
• Batch listkeys authenticated to the Batch data plane, created a job, and read it back without allocating a compute pool.
• Cognitive Services regenerateKey returned a changed key that completed a Language sentiment request with HTTP 200. Maps regenerateKey returned a changed key that completed a Timezone request with HTTP 200.
• Managed Redis database listKeys authenticated over TLS, wrote and read a canary. RegenerateKey returned a changed key that authenticated and recovered the same canary after propagation.
• Rejected paths were kept Medium: Storage local-user listKeys returned an SMB-shaped key but Azure Files rejected authentication; Maps listSas could not produce a usable token without an attached UAMI data role; Web PubSub generateToken alone cannot pass the documented handshake recheck for clientConnection/write. Legacy Azure Cache for Redis rejected new deployment because of retirement.
• CloudPEASS was rebased on concurrent main changes and passes 362 tests, 1 skip, and 229 subtests. A real macOS/zsh AzurePEASS run succeeded. HackTricks master was merged into this branch and mdbook build succeeded.
• Cleanup audit is zero across active test groups/resources, Key Vault/App Configuration/API Management/Cognitive soft deletes, Entra apps/service principals, and local temporary artifacts.

Additional live validation (fourth 2026-09-08 pass)

• Batch regeneratekeys/action returned a replacement primary key that listed jobs, created a job, and read it back; the old primary failed and the untouched secondary remained valid.
• Service Bus and Event Hubs Geo-DR alias listkeys/action variants returned alias connection strings. The Service Bus key sent and recovered the exact queue canary; the Event Hubs key published through the alias with HTTP 201.
• Fluid Relay list/regenerate operations produced tenant keys that created a collaboration container and reopened it after rotation to recover the exact SharedMap canary.
• Quantum workspace list/regenerate operations produced data-plane keys that listed jobs with HTTP 200; the regenerated key became valid after the documented propagation delay. No quantum job was submitted.
• Purview account listkeys/action bypassed the managed-resource-group key boundary and used the returned connection string to inject a canary into the protected atlas_hook Event Hub. Receive access was not claimed because the system epoch receiver rejected the competing client.
• API Management Developer tier validated three additional Critical paths: identity-provider listSecrets recovered an exact Entra client secret that obtained a token; tenant listSecrets signed a direct-management request that returned HTTP 200; gateway generateToken authenticated the official self-hosted gateway image and synchronized assigned configuration containing the exact backend credential.
• ACR listCredentials authenticated to the registry /v2/ endpoint with HTTP 200. Container Apps listSecrets recovered that exact stored ACR password from a scale-to-zero app and independently authenticated with HTTP 200.
• Negative controls remained unpromoted: APIM gateway raw listKeys values were rejected by the official container; model-provider credential operations return metadata rather than values; Web API Connection listConnectionKeys returned OperationNotAllowed; API Center credential retrieval could not be authorized without the missing data-plane role; and the undocumented Inference Service preview resource rejected creation.
• Validation after rebasing concurrent CloudPEASS work: 373 tests passed, 1 skipped, and 242 subtests passed. A real Azure CLI-backed AzurePEASS run completed successfully, and mdbook build succeeded.
• Cleanup audit returned zero active test groups/resources, Entra apps/service principals, matching soft-deleted Key Vault/App Configuration/APIM/Cognitive objects, Docker artifacts, and temporary directories. Purview and API Center were restored to Unregistered; the empty Inference Service namespace accepted deregistration and remained in Azure's asynchronous Unregistering state at the final audit.

Additional live validation (fifth 2026-09-08 pass)

• Cosmos DB databaseAccounts/listConnectionStrings/action returned a primary SQL connection string. A fresh Cosmos SDK client created only from that string read the exact protected canary item, so the standalone action is Critical.
• ACR registries/generateCredentials/action independently rotated an existing token password without tokens/write. The generated credential listed a protected tag and deleted its canary manifest, so the standalone action is Critical and the old two-permission combination was corrected.
• Storage localusers/regeneratePassword/action returned a new local-user password that authenticated over SFTP and downloaded a protected blob with an exact hash match. It is now aligned as Critical in the direct classifier and configured attack catalog.
• Notification Hubs pnsCredentials/action returned the exact seeded Firebase/GCM API key while ordinary hub GET output redacted it. This configuration-dependent external credential disclosure is High.
• Application Insights Components/ApiKeys/Action minted a ReadTelemetry key; using only that key against the data-plane query API recovered the exact seeded custom event. This sensitive-telemetry path is High.
• Tested negatives remain unpromoted: Bot generic OAuth listwithsecrets returned null secrets across current API versions; Storage local-user listKeys did not authenticate to Azure Files; Logic workflow access-key output was not independently converted into an accepted SAS; and Compute restore-point retrieveSasUris returned OperationNotAllowed because the endpoint is unsupported.
• Every finding is documented in its existing Container Registry, Cosmos DB, Monitor, Notification Hubs, or Storage privilege-escalation page. No catch-all file was added.
• Complete CloudPEASS validation: 381 tests passed, 1 skipped, and 247 subtests passed. A real macOS/zsh Azure CLI-backed AzurePEASS run completed successfully, and mdbook build succeeded.
• Final cleanup is zero across active test groups/resources, matching soft-deletes, Entra apps/service principals, temporary dependencies, Docker artifacts, and test-only CLI extensions.