azure-appsvc-publishxml-exposescred
Companion to azure-appsvc-publishxml: the site exposes its long-lived publishing-profile (SCM/FTP) credential via publishxml/action.
match (effective permission)
{
"action": "Microsoft.Web/sites/publishxml/action",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source | <Microsoft.Web/sites> |
|---|---|
| target | <publishing profile credential of the site> |
| permissions | Microsoft.Web/sites/publishxml/action |
| conditions | service_state |
Narrative
App Service {source.name} exposes its publishing-profile (SCM/FTP) credential via publishxml/action.
Raw rule rules/derived/azure/appservice.yaml
id: azure-appsvc-publishxml-exposescred
emits: ExposesCredential
description: 'Companion to azure-appsvc-publishxml: the site exposes its long-lived publishing-profile
(SCM/FTP) credential via publishxml/action.'
match_effective_permission:
action: Microsoft.Web/sites/publishxml/action
scope_type: resource|resourceGroup|subscription
emit:
source: <Microsoft.Web/sites>
target: <publishing profile credential of the site>
permissions:
- Microsoft.Web/sites/publishxml/action
conditions:
- service_state
note: Fact edge paired with azure-appsvc-publishxml (CanReadSecret).
false_positive_note: Only meaningful if basic auth is enabled (basicPublishingCredentialsPolicies allow=true);
otherwise the exposed creds do not authenticate.
narrative: App Service {source.name} exposes its publishing-profile (SCM/FTP) credential via publishxml/action.