azure-la-std-extensions-write
Deploy attacker code to a Standard Logic App via Kudu/SCM ZipDeploy (extensions/write).
match (effective permission)
{
"action": "Microsoft.Web/sites/extensions/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
target site has kind containing 'workflowapp' (Standard Logic App)
emit
| source type | Identity |
|---|---|
| target type | Compute |
| source | <principal> |
| target | <Standard Logic App site (Workflow or ApplicationPlatform node)> |
| permissions | Microsoft.Web/sites/extensions/write |
| conditions | service_state trigger_exists |
| state logic | ACTIVE when code is deployed AND a trigger/invoke path exists. CONDITIONAL (trigger_exists) absent a confirmed trigger. CONDITIONAL(service_state) on a stopped app. BLOCKED if a deny assignment covers extensions/write. |
Narrative
{principal.name} can deploy arbitrary code to Standard Logic App {target.name} via the Kudu extensions API (Microsoft.Web/sites/extensions/write), running attacker code as its managed identity on the next trigger.
Raw rule rules/derived/azure/logicapps.yaml
id: azure-la-std-extensions-write
emits: CanModifyCode
description: Deploy attacker code to a Standard Logic App via Kudu/SCM ZipDeploy (extensions/write).
match_effective_permission:
action: Microsoft.Web/sites/extensions/write
scope_type: resource|resourceGroup|subscription
where:
- target site has kind containing 'workflowapp' (Standard Logic App)
emit:
source_type: Identity
target_type: Compute
source: <principal>
target: <Standard Logic App site (Workflow or ApplicationPlatform node)>
permissions:
- Microsoft.Web/sites/extensions/write
conditions:
- service_state
- trigger_exists
state_logic: ACTIVE when code is deployed AND a trigger/invoke path exists. CONDITIONAL (trigger_exists)
absent a confirmed trigger. CONDITIONAL(service_state) on a stopped app. BLOCKED if a deny assignment
covers extensions/write.
confidence: 0.95
derived_from:
- 'effective permission: Microsoft.Web/sites/extensions/write'
false_positive_note: Standard Logic Apps only (kind=workflowapp on Microsoft.Web/sites). The Standard
tier shares the App Service host runtime with Azure Functions; this extension-write path is identical
to azure-func-extensions-write. Realized on next invoke/restart of the host.
narrative: '{principal.name} can deploy arbitrary code to Standard Logic App {target.name} via the Kudu
extensions API (Microsoft.Web/sites/extensions/write), running attacker code as its managed identity
on the next trigger.'