azure-nh-hub-pns-creds-reads

id: azure-nh-hub-pns-creds-reads
emits: CanReadSecret
description: Retrieve all PNS credentials (APNS cert/token, FCM API key, WNS packageSid+secret, etc.)
  from a Notification Hub via ARM pnsCredentials; credentials are reusable outside Azure.
match_effective_permission:
  action: Microsoft.NotificationHubs/namespaces/notificationHubs/pnsCredentials/action
  scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds pnsCredentials/action at the notificationHub scope
- the hub has at least one PNS credential configured (gcmCredential, apnsCredential, wnsCredential, admCredential,
  baiduCredential, browserCredential, or xiaomiCredential is non-null)
emit:
  source_type: Identity
  target_type: APIKey
  source: <principal>
  target: <PNS credential bundle on the notification hub (APIKey for FCM; separate Credential nodes for
    APNS/WNS in production)>
  permissions:
  - Microsoft.NotificationHubs/namespaces/notificationHubs/pnsCredentials/action
  conditions: []
  state_logic: ACTIVE when the effective ARM permission is confirmed at the hub scope (resource, resource
    group, or subscription) AND the hub has at least one PNS credential configured. The POST .../pnsCredentials
    response returns all configured credential bundles immediately. BLOCKED when a deny assignment covers
    pnsCredentials/action at the effective scope. POTENTIAL when the presence of PNS credentials cannot
    be confirmed from ARM read metadata alone (the GET /notificationHubs response masks credential values;
    presence can be inferred from platform registration data).
  confidence: 0.85
  derived_from:
  - 'effective permission: Microsoft.NotificationHubs/namespaces/notificationHubs/pnsCredentials/action'
  - 'ContainsCredential: ?hub stores PNS credential bundle'
  - 'credential-chains.yaml: CredentialsFor links PNS credentials to external PNS services (FCM, APNS,
    WNS) when separately modeled'
  false_positive_note: "Confidence 0.85 (reduced from 0.90) because PNS credential presence cannot be\
    \ confirmed from the ARM read response alone (values are masked); the collector must call the pnsCredentials\
    \ POST action explicitly to confirm. Downgrade to POTENTIAL when hub registration data does not confirm\
    \ any platform-specific registrations (suggesting PNS may not be configured). PNS credentials authenticate\
    \ to EXTERNAL PNS services (Google FCM, Apple APNS, Microsoft WNS), not to Azure RBAC or CSP identities\
    \ \u2014 do not chain into CanExecuteAs or CanEnterSubscription from these credentials. Their value\
    \ is impact (push notification hijacking, social engineering, device token enumeration), not CSP privilege\
    \ escalation. The target_type APIKey covers FCM (googleApiKey); APNS cert and WNS secret are modeled\
    \ as Certificate/Credential in production systems."
  narrative: "{principal.name} can retrieve PNS credentials from notification hub {target.name} (pnsCredentials/action);\
    \ the returned bundle includes live credential material such as FCM API keys, APNS certificates/tokens,\
    \ and WNS secrets \u2014 each usable outside Azure to send push notifications to all devices registered\
    \ with those credentials, independent of Azure RBAC."