azure-cosmosdb-listconnectionstrings-full-exfiltrate

listConnectionStrings/action returns connection strings embedding full master keys - equivalent complete data exfiltration as listKeys.

derived azure emits CanExfiltrate

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`NoSQLDatabase`
source	`?principal`
target	`?account`
permissions	`Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action`
conditions	`iam_permission`
state logic	if deny assignment covers listConnectionStrings/action: BLOCKED; elif ?account.properties.disableLocalAuth == true: BLOCKED (data-plane endpoint rejects key-based auth with 401; the key in the connection string cannot authenticate); else ACTIVE. ARM-plane call — not gated by Cosmos DB IP firewall.

source type

Identity

target type

NoSQLDatabase

source

?principal

target

?account

permissions

Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action

conditions

iam_permission

state logic

if deny assignment covers listConnectionStrings/action: BLOCKED; elif ?account.properties.disableLocalAuth == true: BLOCKED (data-plane endpoint rejects key-based auth with 401; the key in the connection string cannot authenticate); else ACTIVE. ARM-plane call — not gated by Cosmos DB IP firewall.

Narrative

{principal.name} can call listConnectionStrings on {account.name} (Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action), retrieving connection strings that embed the primary and secondary master keys. These enable the same complete data exfiltration as listKeys - full read, write, and delete access to every database and container regardless of Azure RBAC or IP firewall configuration.

Raw rule rules/derived/azure/cosmosdb.yaml

id: azure-cosmosdb-listconnectionstrings-full-exfiltrate
emits: CanExfiltrate
description: "listConnectionStrings/action returns connection strings embedding full master keys \u2014\
  \ equivalent complete data exfiltration as listKeys."
match:
- - principal: null
  - HasPermission
  - account: null
where:
- node_class(?account) == Data and node_type(?account) == NoSQLDatabase
- node_type(?account) matched provider_type == 'Microsoft.DocumentDB/databaseAccounts'
- ?principal has EFFECTIVE Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action at ?account
  scope
- 'NOT ?principal has EFFECTIVE Microsoft.DocumentDB/databaseAccounts/listKeys/action at ?account scope  #
  avoid double-emit; listKeys subsumes this'
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: ?principal
  target: ?account
  permissions:
  - Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action
  conditions:
  - iam_permission
  state_logic: "if deny assignment covers listConnectionStrings/action: BLOCKED; elif ?account.properties.disableLocalAuth\
    \ == true: BLOCKED (data-plane endpoint rejects key-based auth with 401; the key in the connection\
    \ string cannot authenticate); else ACTIVE. ARM-plane call \u2014 not gated by Cosmos DB IP firewall."
  confidence: '0.95'
  derived_from:
  - <HasPermission edge_id (listConnectionStrings/action)>
  false_positive_note: "Emit only when listConnectionStrings is present but listKeys is not (listKeys\
    \ subsumes this via azure-cosmosdb-listkeys-full-exfiltrate). Connection string contains the master\
    \ key in URI format \u2014 equivalent data-plane access. ARM-plane call, not gated by IP firewall.\
    \ Cosmos DB Operator explicitly excludes listConnectionStrings/* \u2014 verify notActions. disableLocalAuth=true:\
    \ same treatment as listKeys \u2014 connection string has the key but data endpoint rejects it."
  narrative: "{principal.name} can call listConnectionStrings on {account.name} (Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action),\
    \ retrieving connection strings that embed the primary and secondary master keys. These enable the\
    \ same complete data exfiltration as listKeys \u2014 full read, write, and delete access to every\
    \ database and container regardless of Azure RBAC or IP firewall configuration."