azure-appsvc-execute-as-via-publishxml
Publishing profile creds -> Kudu ZipDeploy/command API -> code in the worker -> execute as the site MI.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?publishCreds is the publishing profile of ?site (from sites/publishxml/action)
basicPublishingCredentialsPolicies for SCM is enabled (allow=true)
?mi.privilege_level >= ?principal.privilege_level
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <managed identity> |
| permissions | Microsoft.Web/sites/publishxml/action |
| conditions | service_state network_reachability |
Narrative
{principal.name} can use the publishing profile of {site.name} to deploy code via Kudu and run as its identity {mi.name}.
Raw rule rules/derived/azure/appservice.yaml
id: azure-appsvc-execute-as-via-publishxml
emits: CanExecuteAs
description: Publishing profile creds -> Kudu ZipDeploy/command API -> code in the worker -> execute as
the site MI.
match:
- - principal: null
- CanReadSecret
- publishCreds: null
- - site: null
- ExecutesAs
- mi: null
where:
- ?publishCreds is the publishing profile of ?site (from sites/publishxml/action)
- basicPublishingCredentialsPolicies for SCM is enabled (allow=true)
- ?mi.privilege_level >= ?principal.privilege_level
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <managed identity>
conditions:
- service_state
- network_reachability
permissions:
- Microsoft.Web/sites/publishxml/action
derived_from:
- <CanReadSecret edge_id>
- <ExecutesAs edge_id>
false_positive_note: Only if SCM basic auth is enabled and the Kudu (scm) endpoint is network-reachable
(no private-endpoint-only / access-restriction block). If basic auth disabled -> BLOCKED unless attacker
can re-enable it.
narrative: '{principal.name} can use the publishing profile of {site.name} to deploy code via Kudu and
run as its identity {mi.name}.'