azure-appconfig-kv-write-poison

id: azure-appconfig-kv-write-poison
emits: CanWriteData
description: Writing a key-value can poison config a downstream app trusts (e.g. swap a connection string
  endpoint).
match:
- - principal: null
  - HasPermission
  - store: null
- - store: null
  - Contains
  - dataplane: null
where:
- node_class(?store) == ManagementService
- provider_type(?store) == 'Microsoft.AppConfiguration/configurationStores'
- node_class(?dataplane) == Data
- ?principal has EFFECTIVE Microsoft.AppConfiguration/configurationStores/keyValues/write at the store
  scope (App Configuration Data Owner / custom role)
emit:
  source: ?principal
  target: ?dataplane
  permissions:
  - Microsoft.AppConfiguration/configurationStores/keyValues/write
  conditions:
  - iam_permission
  state_logic: ACTIVE for the write capability itself. Onward execution/exfil is CONDITIONAL on a consuming
    workload reading and trusting the mutated value. BLOCKED under a deny on keyValues/write.
  confidence: '0.7'
  derived_from:
  - ?principal HasPermission ?store (keyValues/write)
  - ?store Contains ?dataplane
  false_positive_note: 'This is a supply-chain primitive, not a direct escalation: it only yields privilege
    when a downstream app actually consumes the poisoned key-value (e.g. redirecting a DB/storage connection
    string to an attacker endpoint to capture credentials, or flipping a feature flag that gates auth).
    Do not roll this up to CanExecuteAs/CanEscalateTo without a modeled consumer.'
  narrative: '{principal.name} can write key-values in {store.name} (keyValues/write), enabling config
    poisoning of apps that read them.'