azure-dns-dangling-cname-takeover

id: azure-dns-dangling-cname-takeover
emits: ExposedToInternet
description: 'A CNAME or A/AAAA alias DNS record in a public Azure DNS zone pointing to a deprovisioned
  Azure resource enables subdomain takeover: an external attacker can claim that resource name and inherit
  DNS resolution for the dangling hostname.'
where:
- DNS zone is a public zone (Microsoft.Network/dnsZones), NOT a private zone
- Record type is CNAME, or an A/AAAA record where properties.targetResource.id is set (ARM resource alias)
- The CNAME value or alias target resolves to an Azure-managed FQDN suffix whose backing resource no longer
  exists in ARM inventory across all collected subscriptions
- "Target FQDN suffix is from a known-claimable Azure service: *.blob.core.windows.net, *.azurewebsites.net,\
  \ *.azurefd.net, *.azureedge.net, *.trafficmanager.net, *.azurestaticapps.net, *.azure-api.net, *.cloudapp.azure.com,\
  \ *.servicebus.windows.net, *.azurecontainer.io, *.azurecr.io (partial list \u2014 verify per Microsoft\
  \ guidance)"
emit:
  source_type: DNS
  target_type: AnonymousIdentity
  source: <public DNS zone containing the dangling record>
  target: <AnonymousIdentity>
  permissions: []
  state_logic: "ACTIVE when: (1) the CNAME value or alias target maps to a known-claimable Azure FQDN\
    \ suffix AND (2) the backing Azure resource does not exist in collected ARM inventory (resource type\
    \ + name + subscription confirmed absent). POTENTIAL when the backing resource's subscription is not\
    \ in collection scope (absence may be a collection gap rather than true deprovisioning). Do not emit\
    \ ACTIVE for private DNS zones (privateDnsZones) \u2014 private zone CNAMEs are not internet-resolvable\
    \ and do not yield external takeover."
  derived_from:
  - <DNS record set ARM record (zone + record type + CNAME value / alias target)>
  - '<ARM inventory cross-reference: target resource not found>'
  false_positive_note: "Only emit for known-claimable Azure service FQDN suffixes. Azure public IP addresses\
    \ (*.eastus.cloudapp.azure.com) allocated to the subscription are NOT claimable externally if they\
    \ still exist in ARM \u2014 confirm the IP resource is absent from the subscription. Internal or on-premises\
    \ FQDNs (non-Azure suffixes) pointed to by the CNAME are outside Azure's claimable surface and may\
    \ still be under the organization's control; do not emit. MX, NS, TXT dangling records do not directly\
    \ enable subdomain takeover in the same way as CNAME/A-alias; they may enable email-spoofing paths\
    \ but are handled separately. Verify the target resource is genuinely absent \u2014 not merely in\
    \ a subscription outside the collection scope. Downgrade to POTENTIAL whenever collection coverage\
    \ is incomplete."
  narrative: DNS record {record.name}.{zone.name} is a dangling CNAME pointing to {record.cname_value},
    which resolves to a deprovisioned Azure resource. An external party can claim that resource and inherit
    public DNS resolution for this hostname, enabling subdomain takeover (content injection, cookie theft,
    OAuth redirect abuse).