azure-frontdoor-ruleset-write
Write access to AFD rule sets and rules (Microsoft.Cdn/profiles/ruleSets/rules/write) lets an attacker inject response headers (including Set-Cookie), perform request redirects to attacker-controlled URLs, and modify URL rewrites - all without touching origins or WAF.
match (effective permission)
{
"action": "Microsoft.Cdn/profiles/ruleSets/rules/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | GenericNetwork |
| source | <principal> |
| target | <AFD rule set / routing rule node (Microsoft.Cdn/profiles/ruleSets/rules)> |
| permissions | Microsoft.Cdn/profiles/ruleSets/rules/write |
| state logic | ACTIVE: the principal can add/modify AFD routing and rewrite rules immediately. Effect is realized when a rule with header injection or redirect is activated. |
Narrative
{principal.name} can modify AFD routing and rewrite rules (Microsoft.Cdn/profiles/ruleSets/rules/write), enabling header injection, request redirects, and URL rewrites on the CDN endpoint.
Raw rule rules/derived/azure/frontdoor.yaml
id: azure-frontdoor-ruleset-write
emits: CanModifyConfiguration
description: "Write access to AFD rule sets and rules (Microsoft.Cdn/profiles/ruleSets/rules/write) lets\
\ an attacker inject response headers (including Set-Cookie), perform request redirects to attacker-controlled\
\ URLs, and modify URL rewrites \u2014 all without touching origins or WAF."
match_effective_permission:
action: Microsoft.Cdn/profiles/ruleSets/rules/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: GenericNetwork
source: <principal>
target: <AFD rule set / routing rule node (Microsoft.Cdn/profiles/ruleSets/rules)>
permissions:
- Microsoft.Cdn/profiles/ruleSets/rules/write
state_logic: 'ACTIVE: the principal can add/modify AFD routing and rewrite rules immediately. Effect
is realized when a rule with header injection or redirect is activated.'
derived_from:
- '<effective permission record: Microsoft.Cdn/profiles/ruleSets/rules/write>'
false_positive_note: This is NOT included in CDN Endpoint Contributor's default permission set; requires
CDN Contributor (Microsoft.Cdn/profiles/*) or a custom role bundling ruleSets/rules/write. A deny
assignment covering Microsoft.Cdn/profiles/ruleSets/rules/write at the profile, RG, or subscription
scope blocks this -> emit BLOCKED.
narrative: '{principal.name} can modify AFD routing and rewrite rules (Microsoft.Cdn/profiles/ruleSets/rules/write),
enabling header injection, request redirects, and URL rewrites on the CDN endpoint.'