azure-frontdoor-origin-write
Write access to AFD origin configuration (Microsoft.Cdn/profiles/originGroups/origins/write) lets an attacker replace an origin's hostname with an attacker-controlled server, causing AFD to forward real user requests (with authentication headers and session cookies) to attacker infrastructure.
match (effective permission)
{
"action": "Microsoft.Cdn/profiles/originGroups/origins/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | PublicEndpoint |
| source | <principal> |
| target | <AFD origin node (Microsoft.Cdn/profiles/originGroups/origins)> |
| permissions | Microsoft.Cdn/profiles/originGroups/origins/write |
| state logic | ACTIVE: the principal can replace the origin hostname immediately; AFD begins routing traffic to the new hostname on the next config propagation (typically < 90 seconds for AFD Standard/Premium). Effect is realized when an attacker- controlled hostName is written to the origin. |
Narrative
{principal.name} can replace the origin hostname for {target.name} (Microsoft.Cdn/profiles/originGroups/origins/write), redirecting AFD production traffic - including user authentication tokens and session cookies - to an attacker-controlled host.
Raw rule rules/derived/azure/frontdoor.yaml
id: azure-frontdoor-origin-write
emits: CanModifyConfiguration
description: Write access to AFD origin configuration (Microsoft.Cdn/profiles/originGroups/origins/write)
lets an attacker replace an origin's hostname with an attacker-controlled server, causing AFD to forward
real user requests (with authentication headers and session cookies) to attacker infrastructure.
match_effective_permission:
action: Microsoft.Cdn/profiles/originGroups/origins/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: PublicEndpoint
source: <principal>
target: <AFD origin node (Microsoft.Cdn/profiles/originGroups/origins)>
permissions:
- Microsoft.Cdn/profiles/originGroups/origins/write
state_logic: 'ACTIVE: the principal can replace the origin hostname immediately; AFD begins routing
traffic to the new hostname on the next config propagation (typically < 90 seconds for AFD Standard/Premium).
Effect is realized when an attacker- controlled hostName is written to the origin.'
derived_from:
- '<effective permission record: Microsoft.Cdn/profiles/originGroups/origins/write>'
false_positive_note: "A deny assignment covering Microsoft.Cdn/profiles/originGroups/origins/write at\
\ the profile, RG, or subscription scope blocks this -> emit BLOCKED. CDN Contributor (Microsoft.Cdn/profiles/*)\
\ includes origins/write. CDN Endpoint Contributor does NOT include originGroups/origins/write \u2014\
\ origin-group and origins writes are not in that role; verify effective permissions carefully. For\
\ Classic CDN, the equivalent is Microsoft.Cdn/profiles/endpoints/origins/write. Replacing the origin\
\ redirects live production traffic, including authenticated user requests; this is a high-impact\
\ misconfiguration. Honor the scope of the grant: a grant at the specific origin resource scope affects\
\ only that origin, not all origins in the profile. Do not emit for read-only roles (CDN Reader)."
narrative: "{principal.name} can replace the origin hostname for {target.name} (Microsoft.Cdn/profiles/originGroups/origins/write),\
\ redirecting AFD production traffic \u2014 including user authentication tokens and session cookies\
\ \u2014 to an attacker-controlled host."