azure-appgw-write

id: azure-appgw-write
emits: CanModifyConfiguration
description: "Writing an Application Gateway allows an attacker to redirect routing rules to attacker-controlled\
  \ backends, swap SSL certificates, or modify the WAF policy binding \u2014 all without touching the\
  \ backend VMs."
match_effective_permission:
  action: Microsoft.Network/applicationGateways/write
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: LoadBalancer
  source: <principal>
  target: <Microsoft.Network/applicationGateways in scope>
  permissions:
  - Microsoft.Network/applicationGateways/write
  escalation: '(a) Change requestRoutingRules[*].backendAddressPool to an attacker-controlled IP/FQDN:
    all matched HTTP/HTTPS traffic (including user sessions and credentials) is now forwarded to the attacker
    after SSL termination at the App GW. (b) Remove the WAF policy reference: L7 attack filtering is removed
    for all requests. (c) Change frontendIPConfigurations to add a public IP to a previously internal
    App GW.'
  conditions:
  - service_state
  state_logic: ACTIVE if the gateway is running (powerState != Stopped). CONDITIONAL(service_state) if
    the gateway is stopped (the write can still be applied but takes effect at next start).
  false_positive_note: applicationGateways/write is a high-privilege operation (effectively full control).
    An attacker redirecting backend pool targets receives decrypted (post-SSL-termination) traffic. The
    impact requires the gateway to be in use by production traffic; a staging or unused gateway is lower
    impact but still a configuration-mutation fact. Confirm no deny assignment covers this operation.
  narrative: '{principal.name} can modify Application Gateway {target.name} (Microsoft.Network/applicationGateways/write).
    An attacker can redirect routing rules to an attacker-controlled backend, receiving decrypted application
    traffic after SSL termination, or remove WAF protection from all requests.'