azure-dns-ns-write-public
Write access to NS records in a public DNS zone lets an attacker replace the name-server delegation for the zone (or a sub-zone), routing all subsequent DNS queries through attacker-controlled authoritative nameservers - a higher-blast-radius attack than single-record modification.
match (effective permission)
{
"action": "Microsoft.Network/dnsZones/NS/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
effective permission covers Microsoft.Network/dnsZones/NS/write (included in dnsZones/*/write and
DNS Zone Contributor)
target is a public DNS zone (Microsoft.Network/dnsZones)
emit
| source type | Identity |
|---|---|
| target type | DNS |
| source | <principal> |
| target | <public DNS zone> |
| permissions | Microsoft.Network/dnsZones/NS/write |
| state logic | ACTIVE: the attacker can overwrite NS records at the zone immediately. Full takeover requires the parent registrar / delegating zone to also honor the new NS values; within Azure DNS, NS records in child zones can be modified to point outside Azure's nameservers. CONDITIONAL(network_reachability) if the parent zone's delegation cannot be confirmed updated (registrar-level step is outside ARM); emit as ACTIVE for the in-zone write capability and note the registrar dependency in the narrative. |
Narrative
{principal.name} can write NS records in public DNS zone {target.name} (Microsoft.Network/dnsZones/NS/write), enabling delegation of the zone (or sub-zone) to attacker-controlled nameservers - all resolution for names in that zone will follow the attacker's authoritative server once TTL expires.
Raw rule rules/derived/azure/dns.yaml
id: azure-dns-ns-write-public
emits: CanModifyConfiguration
description: "Write access to NS records in a public DNS zone lets an attacker replace the name-server\
\ delegation for the zone (or a sub-zone), routing all subsequent DNS queries through attacker-controlled\
\ authoritative nameservers \u2014 a higher-blast-radius attack than single-record modification."
match_effective_permission:
action: Microsoft.Network/dnsZones/NS/write
scope_type: resource|resourceGroup|subscription
where:
- effective permission covers Microsoft.Network/dnsZones/NS/write (included in dnsZones/*/write and DNS
Zone Contributor)
- target is a public DNS zone (Microsoft.Network/dnsZones)
emit:
source_type: Identity
target_type: DNS
source: <principal>
target: <public DNS zone>
permissions:
- Microsoft.Network/dnsZones/NS/write
state_logic: 'ACTIVE: the attacker can overwrite NS records at the zone immediately. Full takeover requires
the parent registrar / delegating zone to also honor the new NS values; within Azure DNS, NS records
in child zones can be modified to point outside Azure''s nameservers. CONDITIONAL(network_reachability)
if the parent zone''s delegation cannot be confirmed updated (registrar-level step is outside ARM);
emit as ACTIVE for the in-zone write capability and note the registrar dependency in the narrative.'
derived_from:
- '<effective RBAC record: dnsZones/NS/write on the zone>'
false_positive_note: Overwriting Azure DNS NS records changes what Azure DNS stores, but the authoritative
delegation at the parent registrar / parent DNS zone is a separate control plane. For a fully attacker-controlled
zone, the attacker would also need to update the registrar delegation (outside ARM scope). However,
overwriting a delegated sub-zone's NS record within Azure DNS IS immediately effective for any resolver
that queries that sub-zone's NS from Azure's servers. Note TTL caching. Do not conflate this with
a full internet-wide hijack unless the parent delegation is also confirmed changeable.
narrative: "{principal.name} can write NS records in public DNS zone {target.name} (Microsoft.Network/dnsZones/NS/write),\
\ enabling delegation of the zone (or sub-zone) to attacker-controlled nameservers \u2014 all resolution\
\ for names in that zone will follow the attacker's authoritative server once TTL expires."