rage.fail

azure-func-publishing-creds

derived azure emits CanReadSecret

match (effective permission)

{ "action": "Microsoft.Web/sites/config/list/Action", "scope_type": "resource|resourceGroup|subscription" }

where

Microsoft.Web/sites/config/list/Action alone returns the publishing credentials (List Web App security sensitive settings, such as publishing credentials, app settings and connection strings); publish/Action and publishxml/Action are strengthening evidence but not required

emit

source	`<principal>`
target	`<SCM/Kudu + FTP publishing credentials>`
permissions	`Microsoft.Web/sites/config/list/Action` `Microsoft.Web/sites/publish/Action` `Microsoft.Web/sites/publishxml/Action`
conditions	`resource_policy`

Narrative

{principal.name} can extract SCM/Kudu + FTP publishing credentials of {target.name} (config/list/Action; optionally strengthened by publish/publishxml).

Raw rule rules/derived/azure/functions.yaml

id: azure-func-publishing-creds
emits: CanReadSecret
match_effective_permission:
  action: Microsoft.Web/sites/config/list/Action
  scope_type: resource|resourceGroup|subscription
optional_permission:
- Microsoft.Web/sites/publish/Action
- Microsoft.Web/sites/publishxml/Action
where:
- Microsoft.Web/sites/config/list/Action alone returns the publishing credentials (List Web App security
  sensitive settings, such as publishing credentials, app settings and connection strings); publish/Action
  and publishxml/Action are strengthening evidence but not required
emit:
  source: <principal>
  target: <SCM/Kudu + FTP publishing credentials>
  permissions:
  - Microsoft.Web/sites/config/list/Action
  - Microsoft.Web/sites/publish/Action
  - Microsoft.Web/sites/publishxml/Action
  conditions:
  - resource_policy
  false_positive_note: config/list/Action alone is sufficient to obtain publishing credentials; publish/publishxml
    are optional strengthening evidence. If basicPublishingCredentialsPolicies (SCM/FTP basic auth) is
    DISABLED, these credentials are unusable -> BLOCKED / downgrade. Honor the policy state.
  narrative: '{principal.name} can extract SCM/Kudu + FTP publishing credentials of {target.name} (config/list/Action;
    optionally strengthened by publish/publishxml).'