azure-acr-import-image
importImage/action copies an external image into a registry tag - supply-chain write equivalent to AcrPush.
match (effective permission)
{
"action": "Microsoft.ContainerRegistry/registries/importImage/action",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Contributor, Owner, or a custom role including Microsoft.
ContainerRegistry/registries/importImage/action
emit
| source type | Identity |
|---|---|
| target type | ContainerRegistry |
| source | <principal> |
| target | <registry> |
| permissions | Microsoft.ContainerRegistry/registries/importImage/action |
| state logic | ACTIVE when the principal can import an image into the registry. CONDITIONAL if the source registry requires additional auth (the import API accepts source registry credentials in the request body — an attacker can supply their own source registry). BLOCKED by deny assignment over importImage/action. |
Narrative
{principal.name} can import images from an external registry into {target.name} (registries/importImage/action); by importing from an attacker-controlled source registry, arbitrary image content is written to a chosen tag - equivalent to AcrPush for supply-chain purposes. container-chains propagates the fan-out to consumers.
Raw rule rules/derived/azure/acr.yaml
id: azure-acr-import-image
emits: CanModifyCode
description: "importImage/action copies an external image into a registry tag \u2014 supply-chain write\
\ equivalent to AcrPush."
match_effective_permission:
action: Microsoft.ContainerRegistry/registries/importImage/action
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Contributor, Owner, or a custom role including Microsoft.ContainerRegistry/registries/importImage/action
emit:
source_type: Identity
target_type: ContainerRegistry
source: <principal>
target: <registry>
permissions:
- Microsoft.ContainerRegistry/registries/importImage/action
state_logic: "ACTIVE when the principal can import an image into the registry. CONDITIONAL if the source\
\ registry requires additional auth (the import API accepts source registry credentials in the request\
\ body \u2014 an attacker can supply their own source registry). BLOCKED by deny assignment over importImage/action."
confidence: 0.92
derived_from:
- container-chains image-push-poisons-consumers (CITED)
- container-chains poisoned-image-executes-as (CITED)
false_positive_note: "importImage is a REST API call (POST to management.azure.com) that writes an image\
\ from a source registry (Docker Hub, another ACR, MCR, public ECR) into a tag in this registry. The\
\ attacker can nominate any source registry they control. Effect on consumers is identical to AcrPush\
\ \u2014 do NOT duplicate the container-chains fan-out. Slightly lower confidence (0.92) because the\
\ import requires constructing an API call with a source specification, vs. a native docker push."
narrative: "{principal.name} can import images from an external registry into {target.name} (registries/importImage/action);\
\ by importing from an attacker-controlled source registry, arbitrary image content is written to\
\ a chosen tag \u2014 equivalent to AcrPush for supply-chain purposes. container-chains propagates\
\ the fan-out to consumers."