azure-pl-pe-dnsgroup-write
Write access to a private endpoint's privateDnsZoneGroups lets an attacker re-link the PE to an attacker-controlled private DNS zone, redirecting DNS resolution of the PaaS service FQDN for that specific PE to an arbitrary IP.
match (effective permission)
{
"action": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | PrivateEndpoint |
| source | <principal> |
| target | <private endpoint> |
| permissions | Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write |
| conditions | service_state |
| state logic | CONDITIONAL(service_state): the principal can immediately replace or add a DNS zone group on the PE, re-linking it to an attacker-controlled private DNS zone. Emit ACTIVE if the attacker already controls or can write to a private DNS zone that is accessible from the PE's VNet (service_state=zone-exists-and-attacker-controls). If the attacker must first create an attacker-controlled zone: emit POTENTIAL (service_state=zone-not-yet-created). The DNS zone must exist and be provisioned for the re-linking to have effect. |
Narrative
{principal.name} can overwrite the DNS zone group on private endpoint {target.name} (privateEndpoints/privateDnsZoneGroups/write). If an attacker-controlled private DNS zone is available, this redirects DNS resolution of the PaaS service FQDN to an arbitrary IP.
Raw rule rules/derived/azure/privatelink.yaml
id: azure-pl-pe-dnsgroup-write
emits: CanModifyConfiguration
description: Write access to a private endpoint's privateDnsZoneGroups lets an attacker re-link the PE
to an attacker-controlled private DNS zone, redirecting DNS resolution of the PaaS service FQDN for
that specific PE to an arbitrary IP.
match_effective_permission:
action: Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: PrivateEndpoint
source: <principal>
target: <private endpoint>
permissions:
- Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write
conditions:
- service_state
state_logic: 'CONDITIONAL(service_state): the principal can immediately replace or add a DNS zone group
on the PE, re-linking it to an attacker-controlled private DNS zone. Emit ACTIVE if the attacker already
controls or can write to a private DNS zone that is accessible from the PE''s VNet (service_state=zone-exists-and-attacker-controls).
If the attacker must first create an attacker-controlled zone: emit POTENTIAL (service_state=zone-not-yet-created).
The DNS zone must exist and be provisioned for the re-linking to have effect.'
derived_from:
- '<effective permission record: privateEndpoints/privateDnsZoneGroups/write>'
false_positive_note: "This capability targets a SPECIFIC PE (not a zone-wide attack). The attacker must\
\ reference a private DNS zone they control or can write to \u2014 this edge does not in isolation\
\ imply zone control. Requires Network Contributor or a custom role granting privateEndpoints/privateDnsZoneGroups/write\
\ at the PE, RG, or sub scope. Deny assignments -> BLOCKED. Lower blast radius than zone record write\
\ (only affects resolution via this specific PE)."
narrative: '{principal.name} can overwrite the DNS zone group on private endpoint {target.name} (privateEndpoints/privateDnsZoneGroups/write).
If an attacker-controlled private DNS zone is available, this redirects DNS resolution of the PaaS
service FQDN to an arbitrary IP.'