azure-pl-dns-zone-record-write
Write access to A or CNAME records in a private DNS zone (e.g., privatelink.vaultcore.azure.net) lets an attacker redirect in-VNet FQDN resolution for a PaaS service to an attacker-controlled IP - intercepting credentials or data sent to that service from any linked VNet.
match (effective permission)
{
"action": "Microsoft.Network/privateDnsZones/A/write OR Microsoft.Network/privateDnsZones/*/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | DNS |
| source | <principal> |
| target | <private DNS zone (e.g., privatelink.vaultcore.azure.net)> |
| permissions | Microsoft.Network/privateDnsZones/A/write Microsoft.Network/privateDnsZones/CNAME/write Microsoft.Network/privateDnsZones/*/write |
| conditions | service_state |
| state logic | CONDITIONAL(service_state): the principal can immediately write or overwrite A/CNAME records in the zone. Impact is realized ONLY if at least one VNet has an active virtual network link to this zone (DNS resolution propagates to that VNet on next TTL expiry). Emit ACTIVE when at least one virtualNetworkLink exists with provisioningState=Succeeded. If no linked VNets are found in inventory, emit CONDITIONAL with condition_note='no VNet link confirmed; zone record write may have no effect if not linked'. Effect extends to all linked VNets — check virtualNetworkLinks to scope the blast radius. |
Narrative
{principal.name} can write A/CNAME records in private DNS zone {target.name} (privateDnsZones/*/write). If the zone is linked to at least one VNet, overwriting the A record for the PaaS service FQDN redirects in-VNet DNS resolution to an attacker-controlled IP, enabling MITM interception of credentials or data.
Raw rule rules/derived/azure/privatelink.yaml
id: azure-pl-dns-zone-record-write
emits: CanModifyConfiguration
description: "Write access to A or CNAME records in a private DNS zone (e.g., privatelink.vaultcore.azure.net)\
\ lets an attacker redirect in-VNet FQDN resolution for a PaaS service to an attacker-controlled IP\
\ \u2014 intercepting credentials or data sent to that service from any linked VNet."
match_effective_permission:
action: Microsoft.Network/privateDnsZones/A/write OR Microsoft.Network/privateDnsZones/*/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: DNS
source: <principal>
target: <private DNS zone (e.g., privatelink.vaultcore.azure.net)>
permissions:
- Microsoft.Network/privateDnsZones/A/write
- Microsoft.Network/privateDnsZones/CNAME/write
- Microsoft.Network/privateDnsZones/*/write
conditions:
- service_state
state_logic: "CONDITIONAL(service_state): the principal can immediately write or overwrite A/CNAME records\
\ in the zone. Impact is realized ONLY if at least one VNet has an active virtual network link to\
\ this zone (DNS resolution propagates to that VNet on next TTL expiry). Emit ACTIVE when at least\
\ one virtualNetworkLink exists with provisioningState=Succeeded. If no linked VNets are found in\
\ inventory, emit CONDITIONAL with condition_note='no VNet link confirmed; zone record write may have\
\ no effect if not linked'. Effect extends to all linked VNets \u2014 check virtualNetworkLinks to\
\ scope the blast radius."
derived_from:
- '<effective permission record: privateDnsZones/A/write or privateDnsZones/*/write>'
false_positive_note: "Private DNS zones affect name resolution ONLY within VNets that have a virtual\
\ network link (autoRegistration=true or false) to the zone. If no VNet is linked, the record write\
\ has no effect on resolution. Confirm that at least one VNet is linked to the zone before emitting\
\ ACTIVE. Private DNS zone write does NOT affect public DNS resolution (Azure-managed zones like vault.azure.net,\
\ blob.core.windows.net are separate public zones). Do NOT emit for public DNS zones (Microsoft.Network/dnsZones)\
\ \u2014 those are covered by azure-vnet-dns-record-write in vnet.yaml. Private DNS Zone Contributor\
\ (role def b12aa53e-6015-4669-85d0-8515ebb3ae7f) grants this capability; Network Contributor does\
\ NOT grant private DNS write unless explicitly scoped. Deny assignments at the zone or RG scope block\
\ this -> BLOCKED."
narrative: '{principal.name} can write A/CNAME records in private DNS zone {target.name} (privateDnsZones/*/write).
If the zone is linked to at least one VNet, overwriting the A record for the PaaS service FQDN redirects
in-VNet DNS resolution to an attacker-controlled IP, enabling MITM interception of credentials or
data.'