azure-evg-subscription-write

id: azure-evg-subscription-write
emits: CanModifyConfiguration
description: Modify an existing event subscription's endpoint, redirecting all future events to an attacker-controlled
  webhook; enables event exfiltration and payload inspection.
match_effective_permission:
  any_of:
  - action: Microsoft.EventGrid/eventSubscriptions/write
    scope_type: resource|resourceGroup|subscription
  - action: Microsoft.EventGrid/topics/eventSubscriptions/write
    scope_type: resource|resourceGroup|subscription
  - action: Microsoft.EventGrid/systemTopics/eventSubscriptions/write
    scope_type: resource|resourceGroup|subscription
where:
- an existing event subscription is present on the topic or system topic
- the subscription has a modifiable endpoint (webhook / Function / Logic App / Service Bus / Storage queue)
emit:
  source_type: Identity
  target_type: EventBus
  source: <principal>
  target: <Event Grid topic or system topic (EventBus) whose subscription is modified>
  permissions:
  - Microsoft.EventGrid/eventSubscriptions/write
  conditions: []
  state_logic: "ACTIVE when the effective permission is confirmed and the subscription endpoint can be\
    \ changed via ARM PATCH. Azure does NOT require the endpoint to confirm the redirect before the subscription\
    \ update takes effect (endpoint validation is sent to the new URL; if the new endpoint is attacker-controlled\
    \ and returns the validation code, the update succeeds). BLOCKED if a deny assignment covers eventSubscriptions/write\
    \ at the scope. Note: changing the endpoint immediately stops event delivery to the original endpoint\
    \ and starts delivery to the new one \u2014 this is a destructive reconfiguration that may be detected."
  confidence: 0.95
  derived_from:
  - 'effective permission: Microsoft.EventGrid/eventSubscriptions/write (or topic/systemTopic variant)'
  - 'can-execute-as.yaml: execute-as-via-config-identity-swap pattern (configuration change redirects
    execution flow)'
  false_positive_note: "Modifying a subscription endpoint REDIRECTS events \u2014 it does NOT inject code\
    \ into the consumer. The escalation is CanReadData (event exfiltration) and potentially CanReadSecret\
    \ if events carry credential material (ContainsSecret path). It is NOT a CanModifyCode on the consumer\
    \ compute. Do not emit CanModifyCode; this is purely configuration-level access to the routing layer.\
    \ The endpoint validation handshake (Event Grid sends a validation event to the new endpoint) means\
    \ the attacker must control the endpoint and be able to respond with the validation code \u2014 this\
    \ is a real condition but trivially satisfied by an attacker-hosted HTTP endpoint. Honor filter conditions:\
    \ if the subscription has a strict event type filter, the attacker only receives events of that type."
  narrative: '{principal.name} holds Microsoft.EventGrid/eventSubscriptions/write on topic {target.name};
    it can change the subscription delivery endpoint to an attacker-controlled webhook, routing all future
    events from that topic to the attacker. If events carry credential material, credential-chains derives
    CanImpersonate via ContainsSecret + CredentialsFor.'