azure-dns-private-vnet-link-write
Write access to VNet links on a private DNS zone lets an attacker add new VNet links, extending the zone's resolution scope to additional VNets - including VNets in other subscriptions within the same tenant - expanding the blast radius of any private DNS record modification.
match (effective permission)
{
"action": "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
effective permission covers Microsoft.Network/privateDnsZones/virtualNetworkLinks/write
target is a private
DNS zone
emit
| source type | Identity |
|---|---|
| target type | DNS |
| source | <principal> |
| target | <private DNS zone> |
| permissions | Microsoft.Network/privateDnsZones/virtualNetworkLinks/write |
| state logic | ACTIVE: the principal can add or modify VNet links immediately. Adding a link to a new VNet extends the zone's resolution scope to workloads in that VNet on the next DNS query refresh (TTL-dependent for existing cached records). Cross-subscription VNet links require the principal to also have Microsoft.Network/virtualNetworks/join/action or similar on the target VNet; CONDITIONAL(iam_permission) when that cross-subscription grant is unconfirmed. |
Narrative
{principal.name} can add VNet links to private DNS zone {target.name} (privateDnsZones/virtualNetworkLinks/write), extending the zone's resolution scope to additional VNets (potentially cross-subscription) and amplifying the impact of any record modification in the zone.
Raw rule rules/derived/azure/dns.yaml
id: azure-dns-private-vnet-link-write
emits: CanModifyConfiguration
description: "Write access to VNet links on a private DNS zone lets an attacker add new VNet links, extending\
\ the zone's resolution scope to additional VNets \u2014 including VNets in other subscriptions within\
\ the same tenant \u2014 expanding the blast radius of any private DNS record modification."
match_effective_permission:
action: Microsoft.Network/privateDnsZones/virtualNetworkLinks/write
scope_type: resource|resourceGroup|subscription
where:
- effective permission covers Microsoft.Network/privateDnsZones/virtualNetworkLinks/write
- target is a private DNS zone
emit:
source_type: Identity
target_type: DNS
source: <principal>
target: <private DNS zone>
permissions:
- Microsoft.Network/privateDnsZones/virtualNetworkLinks/write
state_logic: 'ACTIVE: the principal can add or modify VNet links immediately. Adding a link to a new
VNet extends the zone''s resolution scope to workloads in that VNet on the next DNS query refresh
(TTL-dependent for existing cached records). Cross-subscription VNet links require the principal to
also have Microsoft.Network/virtualNetworks/join/action or similar on the target VNet; CONDITIONAL(iam_permission)
when that cross-subscription grant is unconfirmed.'
derived_from:
- '<effective RBAC record: privateDnsZones/virtualNetworkLinks/write on the zone>'
false_positive_note: Adding a VNet link is only meaningful if the attacker can also write record sets
in the zone (privateDnsZones/*/write); without record write the link expansion alone does not yield
a new redirect. This edge captures the scope-expansion capability; full exploitation chains through
azure-dns-private-record-write. Cross-subscription VNet linking additionally requires join rights
on the target VNet (Microsoft.Network/ virtualNetworks/join/action). Deny assignments at the VNet
scope may block the join.
narrative: '{principal.name} can add VNet links to private DNS zone {target.name} (privateDnsZones/virtualNetworkLinks/write),
extending the zone''s resolution scope to additional VNets (potentially cross-subscription) and amplifying
the impact of any record modification in the zone.'