azure-cosmosdb-listkeys-full-exfiltrate

listKeys/action returns full master keys enabling complete data exfiltration (read/write/delete all items across all databases and containers).

derived azure emits CanExfiltrate

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`NoSQLDatabase`
source	`?principal`
target	`?account`
permissions	`Microsoft.DocumentDB/databaseAccounts/listKeys/action`
conditions	`iam_permission`
state logic	if deny assignment covers listKeys/action: BLOCKED; elif ?account.properties.disableLocalAuth == true: BLOCKED (data-plane endpoint rejects key-based auth with 401; the key is retrievable via ARM but cannot authenticate to the data plane); else ACTIVE. ARM-plane call — not gated by Cosmos DB IP firewall (ipRules/ publicNetworkAccess). The key returned by listKeys grants full read/write/delete on all databases, containers, and items — this is the complete data exfiltration path.

source type

Identity

target type

NoSQLDatabase

source

?principal

target

?account

permissions

Microsoft.DocumentDB/databaseAccounts/listKeys/action

conditions

iam_permission

state logic

if deny assignment covers listKeys/action: BLOCKED; elif ?account.properties.disableLocalAuth == true: BLOCKED (data-plane endpoint rejects key-based auth with 401; the key is retrievable via ARM but cannot authenticate to the data plane); else ACTIVE. ARM-plane call — not gated by Cosmos DB IP firewall (ipRules/ publicNetworkAccess). The key returned by listKeys grants full read/write/delete on all databases, containers, and items — this is the complete data exfiltration path.

Narrative

{principal.name} can call listKeys on {account.name} (Microsoft.DocumentDB/databaseAccounts/listKeys/action), retrieving the primary and secondary master keys. These keys grant full read, write, and delete access to every database and container in the account, enabling complete data exfiltration regardless of Azure RBAC data-plane role assignments or IP firewall configuration.

Raw rule rules/derived/azure/cosmosdb.yaml

id: azure-cosmosdb-listkeys-full-exfiltrate
emits: CanExfiltrate
description: listKeys/action returns full master keys enabling complete data exfiltration (read/write/delete
  all items across all databases and containers).
match:
- - principal: null
  - HasPermission
  - account: null
where:
- node_class(?account) == Data and node_type(?account) == NoSQLDatabase
- node_type(?account) matched provider_type == 'Microsoft.DocumentDB/databaseAccounts'
- ?principal has EFFECTIVE Microsoft.DocumentDB/databaseAccounts/listKeys/action at ?account scope
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: ?principal
  target: ?account
  permissions:
  - Microsoft.DocumentDB/databaseAccounts/listKeys/action
  conditions:
  - iam_permission
  state_logic: "if deny assignment covers listKeys/action: BLOCKED; elif ?account.properties.disableLocalAuth\
    \ == true: BLOCKED (data-plane endpoint rejects key-based auth with 401; the key is retrievable via\
    \ ARM but cannot authenticate to the data plane); else ACTIVE. ARM-plane call \u2014 not gated by\
    \ Cosmos DB IP firewall (ipRules/ publicNetworkAccess). The key returned by listKeys grants full read/write/delete\
    \ on all databases, containers, and items \u2014 this is the complete data exfiltration path."
  confidence: '0.95'
  derived_from:
  - <HasPermission edge_id (listKeys/action)>
  false_positive_note: "This is an ARM-plane call not gated by IP firewall. The key provides unrestricted\
    \ data-plane access \u2014 full exfiltration capability. Do NOT apply network_reachability. Cosmos\
    \ DB Operator (230815da) explicitly excludes listKeys/* from its permissions \u2014 verify notActions.\
    \ When disableLocalAuth=true, the key material exists but the data endpoint rejects key-based authentication\
    \ \u2014 emit BLOCKED state, not ACTIVE."
  narrative: '{principal.name} can call listKeys on {account.name} (Microsoft.DocumentDB/databaseAccounts/listKeys/action),
    retrieving the primary and secondary master keys. These keys grant full read, write, and delete access
    to every database and container in the account, enabling complete data exfiltration regardless of
    Azure RBAC data-plane role assignments or IP firewall configuration.'