rage.fail

azure-appsvc-execute-as-via-config

Config modification (startup command / app settings) on a site + the site runs as an MI => execute as that MI.

derived azure emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanModifyConfiguration {'site': None} {'site': None} ExecutesAs {'mi': None}

where

node_type(?site) == ApplicationPlatform ?mi.privilege_level >= ?principal.privilege_level

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

{'principal': None} CanStart {'site': None}

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<managed identity>`
permissions	`Microsoft.Web/sites/config/write`
state logic	if matched(optional[0]) or ?site running: ACTIVE else: CONDITIONAL(service_state)

Narrative

{principal.name} can set the startup command / app settings of {site.name} and, on restart, run code as its identity {mi.name}.

Raw rule rules/derived/azure/appservice.yaml

id: azure-appsvc-execute-as-via-config
emits: CanExecuteAs
description: Config modification (startup command / app settings) on a site + the site runs as an MI =>
  execute as that MI.
match:
- - principal: null
  - CanModifyConfiguration
  - site: null
- - site: null
  - ExecutesAs
  - mi: null
where:
- node_type(?site) == ApplicationPlatform
- ?mi.privilege_level >= ?principal.privilege_level
optional:
- - principal: null
  - CanStart
  - site: null
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <managed identity>
  state_logic: 'if matched(optional[0]) or ?site running: ACTIVE

    else: CONDITIONAL(service_state)

    '
  conditions_from:
  - site: null
  - mi: null
  permissions:
  - Microsoft.Web/sites/config/write
  derived_from:
  - <CanModifyConfiguration edge_id>
  - <ExecutesAs edge_id>
  false_positive_note: Setting appCommandLine/startup requires a restart to take effect; if the attacker
    cannot restart and the app will not naturally recycle, emit CONDITIONAL(service_state). No MI => do
    not emit.
  narrative: '{principal.name} can set the startup command / app settings of {site.name} and, on restart,
    run code as its identity {mi.name}.'