azure-disk-write-network-policy
disks/write allows changing networkAccessPolicy (e.g. from AllowPrivate to AllowAll), which upgrades CONDITIONAL(network_reachability) SAS-export edges to ACTIVE.
match (effective permission)
{
"action": "Microsoft.Compute/disks/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | BlockStorage |
| source | <principal> |
| target | <managed disk> |
| permissions | Microsoft.Compute/disks/write |
| state logic | ACTIVE when the principal holds disks/write. The security value is that this enables escalation of CONDITIONAL(network_reachability) SAS edges: by setting networkAccessPolicy to AllowAll the attacker removes the private-endpoint restriction on beginGetAccess. |
Narrative
{principal.name} can write the networkAccessPolicy of disk {target.name} (disks/write), potentially removing the private-endpoint SAS restriction and enabling internet-routable SAS export.
Raw rule rules/explicit/azure-disks.yaml
id: azure-disk-write-network-policy
emits: CanModify
description: disks/write allows changing networkAccessPolicy (e.g. from AllowPrivate to AllowAll), which
upgrades CONDITIONAL(network_reachability) SAS-export edges to ACTIVE.
match_effective_permission:
action: Microsoft.Compute/disks/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: BlockStorage
source: <principal>
target: <managed disk>
permissions:
- Microsoft.Compute/disks/write
conditions: []
state_logic: 'ACTIVE when the principal holds disks/write. The security value is that this enables escalation
of CONDITIONAL(network_reachability) SAS edges: by setting networkAccessPolicy to AllowAll the attacker
removes the private-endpoint restriction on beginGetAccess.'
false_positive_note: 'disks/write alone does not directly read data; its security value is indirect:
it enables networkAccessPolicy downgrade (from AllowPrivate to AllowAll), which then enables CanExfiltrate.
A path-finder query should chain: CanModify(disk) + azure-disk-sas-export (with the downgraded policy)
-> CanExfiltrate. Do NOT emit CanExfiltrate directly from CanModify; the policy-change step must be
modeled separately or noted as a POTENTIAL state upgrade.'
narrative: '{principal.name} can write the networkAccessPolicy of disk {target.name} (disks/write),
potentially removing the private-endpoint SAS restriction and enabling internet-routable SAS export.'