azure-appsvc-config-list-exposescred
Companion to azure-appsvc-config-list: the site exposes cleartext app-settings / connection-string secrets via config/list/action.
match (effective permission)
{
"action": "Microsoft.Web/sites/config/list/action",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source | <Microsoft.Web/sites> |
|---|---|
| target | <app settings + connection strings of the site> |
| permissions | Microsoft.Web/sites/config/list/action |
Narrative
App Service {source.name} exposes cleartext app-settings / connection-string secrets via config/list/action.
Raw rule rules/derived/azure/appservice.yaml
id: azure-appsvc-config-list-exposescred
emits: ExposesCredential
description: 'Companion to azure-appsvc-config-list: the site exposes cleartext app-settings / connection-string
secrets via config/list/action.'
match_effective_permission:
action: Microsoft.Web/sites/config/list/action
scope_type: resource|resourceGroup|subscription
emit:
source: <Microsoft.Web/sites>
target: <app settings + connection strings of the site>
permissions:
- Microsoft.Web/sites/config/list/action
note: Fact edge paired with azure-appsvc-config-list (CanReadSecret).
false_positive_note: Key Vault references resolve to a reference string, not the secret, unless already
resolved. Only fires when app settings / connection strings actually contain secret material.
narrative: App Service {source.name} exposes cleartext app-settings / connection-string secrets via
config/list/action.