azure-adf-linkedservice-write-config
Overwrite a linked service definition to inject attacker-controlled credentials or an attacker data source endpoint.
match (effective permission)
{
"action": "Microsoft.DataFactory/factories/linkedservices/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <ADF linked service (ConnectionString node)> |
| permissions | Microsoft.DataFactory/factories/linkedservices/write |
| conditions | trigger_exists |
| state logic | CONDITIONAL(trigger_exists) — the overwritten linked service is used by pipelines on their next run. ACTIVE if the attacker can also trigger a run (pipelines/createRun/action or a Schedule trigger for a pipeline that references this linked service). BLOCKED if a deny assignment covers linkedservices/write. Can also be used to redirect a linked service to an attacker-controlled HTTPS endpoint (exfiltration) or to inject credentials that give the pipeline access to a restricted data source. |
Narrative
{principal.name} can overwrite the linked service {target.name} (Microsoft.DataFactory/factories/linkedservices/write), replacing its connection string or endpoint with attacker-controlled values used on the next pipeline run.
Raw rule rules/derived/azure/datafactory.yaml
id: azure-adf-linkedservice-write-config
emits: CanModifyConfiguration
description: Overwrite a linked service definition to inject attacker-controlled credentials or an attacker
data source endpoint.
match_effective_permission:
action: Microsoft.DataFactory/factories/linkedservices/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <ADF linked service (ConnectionString node)>
permissions:
- Microsoft.DataFactory/factories/linkedservices/write
conditions:
- trigger_exists
state_logic: "CONDITIONAL(trigger_exists) \u2014 the overwritten linked service is used by pipelines\
\ on their next run. ACTIVE if the attacker can also trigger a run (pipelines/createRun/action or\
\ a Schedule trigger for a pipeline that references this linked service). BLOCKED if a deny assignment\
\ covers linkedservices/write. Can also be used to redirect a linked service to an attacker-controlled\
\ HTTPS endpoint (exfiltration) or to inject credentials that give the pipeline access to a restricted\
\ data source."
confidence: 0.85
derived_from:
- 'effective permission: Microsoft.DataFactory/factories/linkedservices/write'
false_positive_note: "Overwriting a linked service with a malicious endpoint only matters when a pipeline\
\ that uses the linked service is triggered \u2014 emit CONDITIONAL (trigger_exists) not ACTIVE unless\
\ a run path is confirmed. When the linked service is Key-Vault-backed, swapping credentials requires\
\ also having access to the KV secret or to specify inline creds instead. Do not conflate this edge\
\ with CanReadSecret \u2014 writing a linked service changes creds but does not read existing ones."
narrative: '{principal.name} can overwrite the linked service {target.name} (Microsoft.DataFactory/factories/linkedservices/write),
replacing its connection string or endpoint with attacker-controlled values used on the next pipeline
run.'