azure-func-http-invoke
Invoke an HTTP-triggered function using a held key (or anonymously).
where
principal holds a function/host key (via listkeys) OR the target function authLevel is anonymous
the app's default hostname or private endpoint is network-reachable by the principal
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <function app / HTTP-triggered function> |
| conditions | network_reachability |
Narrative
{principal.name} can invoke HTTP functions of {target.name} (function/host key or anonymous auth).
Raw rule rules/derived/azure/functions.yaml
id: azure-func-http-invoke
emits: CanInvoke
description: Invoke an HTTP-triggered function using a held key (or anonymously).
where:
- principal holds a function/host key (via listkeys) OR the target function authLevel is anonymous
- the app's default hostname or private endpoint is network-reachable by the principal
emit:
source_type: Identity
source: <principal>
target: <function app / HTTP-triggered function>
conditions:
- network_reachability
false_positive_note: Invoke alone only runs the EXISTING code as the MI; it becomes escalation only
combined with a code/config change or when the existing code is exploitable. authLevel=anonymous needs
no key.
narrative: '{principal.name} can invoke HTTP functions of {target.name} (function/host key or anonymous
auth).'