azure-pl-dns-zone-vnet-link-write
Write access to virtual network links in a private DNS zone lets an attacker link additional VNets to the zone, expanding the blast radius of a compromised or attacker-controlled DNS zone to additional VNets whose resources now resolve PaaS FQDNs via the attacker-influenced zone.
match (effective permission)
{
"action": "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | DNS |
| source | <principal> |
| target | <private DNS zone> |
| permissions | Microsoft.Network/privateDnsZones/virtualNetworkLinks/write |
| state logic | ACTIVE: the principal can immediately create a new virtual network link to the zone from any VNet they can reference (requires at minimum read access on the target VNet to reference its ID). The zone's A records immediately apply to the newly linked VNet on the next DNS refresh. |
Narrative
{principal.name} can add virtual network links to private DNS zone {target.name} (privateDnsZones/virtualNetworkLinks/write). This can extend a compromised or attacker-controlled zone's reach to additional VNets, hijacking PaaS FQDN resolution within those VNets.
Raw rule rules/derived/azure/privatelink.yaml
id: azure-pl-dns-zone-vnet-link-write
emits: CanModifyConfiguration
description: Write access to virtual network links in a private DNS zone lets an attacker link additional
VNets to the zone, expanding the blast radius of a compromised or attacker-controlled DNS zone to additional
VNets whose resources now resolve PaaS FQDNs via the attacker-influenced zone.
match_effective_permission:
action: Microsoft.Network/privateDnsZones/virtualNetworkLinks/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: DNS
source: <principal>
target: <private DNS zone>
permissions:
- Microsoft.Network/privateDnsZones/virtualNetworkLinks/write
state_logic: 'ACTIVE: the principal can immediately create a new virtual network link to the zone from
any VNet they can reference (requires at minimum read access on the target VNet to reference its ID).
The zone''s A records immediately apply to the newly linked VNet on the next DNS refresh.'
derived_from:
- '<effective permission record: privateDnsZones/virtualNetworkLinks/write>'
false_positive_note: Linking a VNet to a zone does NOT grant any data-plane access on the VNet or its
resources; it only changes DNS resolution within that VNet. If the zone already has accurate/benign
A records, this capability alone is low-impact. The attack value is realized only when combined with
zone record write (azure-pl-dns-zone-record-write) or when the zone is attacker-controlled. Deny assignments
at the zone or RG scope block this -> BLOCKED.
narrative: '{principal.name} can add virtual network links to private DNS zone {target.name} (privateDnsZones/virtualNetworkLinks/write).
This can extend a compromised or attacker-controlled zone''s reach to additional VNets, hijacking
PaaS FQDN resolution within those VNets.'