azure-func-hostruntime-modifycode
The admin runtime action can add/replace/delete functions, not just invoke them -> code modification.
match (effective permission)
{
"action": "Microsoft.Web/sites/hostruntime/host/action",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <function app> |
| permissions | Microsoft.Web/sites/hostruntime/host/action |
| conditions | service_state |
Narrative
{principal.name} can add/replace/delete functions on {target.name} via the admin runtime API (hostruntime/host/action), running attacker code as its identity.
Raw rule rules/derived/azure/functions.yaml
id: azure-func-hostruntime-modifycode
emits: CanModifyCode
description: The admin runtime action can add/replace/delete functions, not just invoke them -> code modification.
match_effective_permission:
action: Microsoft.Web/sites/hostruntime/host/action
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
source: <principal>
target: <function app>
permissions:
- Microsoft.Web/sites/hostruntime/host/action
conditions:
- service_state
escalation: Perform Function App runtime actions (sync triggers, ADD functions, invoke functions, DELETE
functions); adding/replacing functions is attacker code execution as the app's MI.
false_positive_note: hostruntime/host/action officially permits add/replace/delete of functions, so
a principal holding it via ARM (not just via the master key) can modify code. Realized on next invoke/restart
-> CONDITIONAL(trigger_exists) absent a trigger. Overlaps azure-func-execute-as-via-masterkey when
reached via the master key -> do not double-count the escalation.
narrative: '{principal.name} can add/replace/delete functions on {target.name} via the admin runtime
API (hostruntime/host/action), running attacker code as its identity.'