rage.fail

azure-appsvc-msi-exposescred

Companion to azure-appsvc-msi-token: the site exposes its bound MI's credential material via the MSI token endpoint reachable from in-worker code.

derived azure emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'site': None} ExecutesAs {'mi': None}

emit

source	`<Microsoft.Web/sites>`
target	`<managed identity bound to the site>`

Narrative

App Service {site.name} exposes the credential of its managed identity {mi.name} via the App Service MSI token endpoint.

Raw rule rules/derived/azure/appservice.yaml

id: azure-appsvc-msi-exposescred
emits: ExposesCredential
description: 'Companion to azure-appsvc-msi-token: the site exposes its bound MI''s credential material
  via the MSI token endpoint reachable from in-worker code.'
match:
- - site: null
  - ExecutesAs
  - mi: null
emit:
  source: <Microsoft.Web/sites>
  target: <managed identity bound to the site>
  permissions: []
  note: Fact edge paired with azure-appsvc-msi-token (CanRetrieveToken). Same MSI endpoint (IDENTITY_ENDPOINT
    + IDENTITY_HEADER).
  false_positive_note: Only fires when the site actually has a managed identity (identity.type != None).
    No MI => no exposure; do NOT emit.
  narrative: App Service {site.name} exposes the credential of its managed identity {mi.name} via the
    App Service MSI token endpoint.