azure-dns-record-write-public
Write access to record sets in a public Azure DNS zone (any record type via wildcard or specific-type write) lets an attacker create or overwrite A, CNAME, MX, or other records, redirecting hostnames under the zone to attacker-controlled infrastructure.
match (effective permission)
{
"action": "Microsoft.Network/dnsZones/*/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
effective permission covers Microsoft.Network/dnsZones/*/write OR at least one specific record-type write (A/write, CNAME/write, MX/write, TXT/write, etc.)
target is a public
DNS zone (Microsoft.Network/dnsZones)
emit
| source type | Identity |
|---|---|
| target type | DNS |
| source | <principal> |
| target | <public DNS zone> |
| permissions | Microsoft.Network/dnsZones/*/write Microsoft.Network/dnsZones/A/write Microsoft.Network/dnsZones/CNAME/write Microsoft.Network/dnsZones/MX/write Microsoft.Network/dnsZones/TXT/write |
| state logic | ACTIVE: the principal can write record sets immediately; no secondary precondition required for the capability itself. The effect (redirect, impersonation) is realized when the attacker creates or overwrites a record. A deny assignment covering the relevant write action at the zone or parent scope -> BLOCKED. |
Narrative
{principal.name} can write DNS record sets in public zone {target.name} (Microsoft.Network/dnsZones/*/write), enabling them to redirect any hostname in the zone to attacker-controlled infrastructure - phishing, session hijack, TLS cert acquisition via DNS-01 ACME challenge, or OAuth redirect abuse.
Raw rule rules/derived/azure/dns.yaml
id: azure-dns-record-write-public
emits: CanModifyConfiguration
description: Write access to record sets in a public Azure DNS zone (any record type via wildcard or specific-type
write) lets an attacker create or overwrite A, CNAME, MX, or other records, redirecting hostnames under
the zone to attacker-controlled infrastructure.
match_effective_permission:
action: Microsoft.Network/dnsZones/*/write
scope_type: resource|resourceGroup|subscription
where:
- effective permission covers Microsoft.Network/dnsZones/*/write OR at least one specific record-type
write (A/write, CNAME/write, MX/write, TXT/write, etc.)
- target is a public DNS zone (Microsoft.Network/dnsZones)
emit:
source_type: Identity
target_type: DNS
source: <principal>
target: <public DNS zone>
permissions:
- Microsoft.Network/dnsZones/*/write
- Microsoft.Network/dnsZones/A/write
- Microsoft.Network/dnsZones/CNAME/write
- Microsoft.Network/dnsZones/MX/write
- Microsoft.Network/dnsZones/TXT/write
state_logic: 'ACTIVE: the principal can write record sets immediately; no secondary precondition required
for the capability itself. The effect (redirect, impersonation) is realized when the attacker creates
or overwrites a record. A deny assignment covering the relevant write action at the zone or parent
scope -> BLOCKED.'
derived_from:
- '<effective RBAC record: dnsZones/*/write or record-type write on the zone>'
false_positive_note: 'Scope matters: DNS Zone Contributor scoped to a single zone does not grant write
on sibling zones or the parent zone. Always resolve the effective permission at the actual zone resource
ID. A principal with only dnsZones/read or dnsZones/*/read has no write capability. NS and SOA write
may be bundled or excluded depending on the built-in role; DNS Zone Contributor explicitly includes
dnsZones/NS/write and dnsZones/SOA/write. If only a specific record type is writable (e.g., A/write
only), annotate the permissions list accordingly rather than emitting with the wildcard.'
narrative: "{principal.name} can write DNS record sets in public zone {target.name} (Microsoft.Network/dnsZones/*/write),\
\ enabling them to redirect any hostname in the zone to attacker-controlled infrastructure \u2014\
\ phishing, session hijack, TLS cert acquisition via DNS-01 ACME challenge, or OAuth redirect abuse."