azure-la-std-sourcecontrols-write
Hijack the source control of a Standard Logic App to an attacker repo (sourcecontrols/Write).
match (effective permission)
{
"action": "Microsoft.Web/sites/sourcecontrols/Write",
"scope_type": "resource|resourceGroup|subscription"
}
where
target site has kind containing 'workflowapp' (Standard Logic App)
emit
| source type | Identity |
|---|---|
| target type | Compute |
| source | <principal> |
| target | <Standard Logic App site> |
| permissions | Microsoft.Web/sites/sourcecontrols/Write |
| conditions | service_state |
| state logic | CONDITIONAL(trigger_exists) — injection realized at next CI/CD sync/deploy. BLOCKED if a deny assignment covers sourcecontrols/Write. |
Narrative
{principal.name} can repoint the source control of Standard Logic App {target.name} to an attacker-controlled repository (sourcecontrols/Write), injecting code at the next CI/CD sync or deploy.
Raw rule rules/derived/azure/logicapps.yaml
id: azure-la-std-sourcecontrols-write
emits: CanModifyCode
description: Hijack the source control of a Standard Logic App to an attacker repo (sourcecontrols/Write).
match_effective_permission:
action: Microsoft.Web/sites/sourcecontrols/Write
scope_type: resource|resourceGroup|subscription
where:
- target site has kind containing 'workflowapp' (Standard Logic App)
emit:
source_type: Identity
target_type: Compute
source: <principal>
target: <Standard Logic App site>
permissions:
- Microsoft.Web/sites/sourcecontrols/Write
conditions:
- service_state
state_logic: "CONDITIONAL(trigger_exists) \u2014 injection realized at next CI/CD sync/deploy. BLOCKED\
\ if a deny assignment covers sourcecontrols/Write."
confidence: 0.85
derived_from:
- 'effective permission: Microsoft.Web/sites/sourcecontrols/Write'
false_positive_note: Standard Logic Apps only. Only yields execution if the continuous deployment /
auto-sync is configured and actually pulls the attacker source. If no auto-sync is configured, downgrade
to POTENTIAL.
narrative: '{principal.name} can repoint the source control of Standard Logic App {target.name} to an
attacker-controlled repository (sourcecontrols/Write), injecting code at the next CI/CD sync or deploy.'