azure-postgres-mysql-admin-reset-writedata

Admin password reset capability plus network reachability yields full data-plane write access (INSERT, UPDATE, DELETE, DROP) on all databases.

derived azure emits CanWriteData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanModifyConfiguration {'server': None}

where

node_class(?server) == Data and node_type(?server) == RelationalDatabase node_type(?server) matched provider_type in ['Microsoft.DBforPostgreSQL/flexibleServers', 'Microsoft.DBforMySQL/flexibleServers'] edge produced by azure-postgres-mysql-admin-password-reset (CanModifyConfiguration from flexibleServers/write on this server)

emit

source type	`Identity`
target type	`RelationalDatabase`
source	`?principal`
target	`?server`
permissions	`Microsoft.DBforPostgreSQL/flexibleServers/write` `Microsoft.DBforMySQL/flexibleServers/write`
conditions	`network_reachability`
state logic	if ?server.properties.publicNetworkAccess == 'Disabled' (private-access topology / VNet injection): CONDITIONAL(network_reachability) — no public endpoint exists; attacker must have a foothold in the delegated subnet or a peered VNet to reach port 5432/3306; elif ?server.properties.publicNetworkAccess == 'Enabled' AND a firewall rule admitting the attacker's source IP exists (or rule 0.0.0.0–255.255.255.255): ACTIVE; elif ?server.properties.publicNetworkAccess == 'Enabled' AND no firewall rule covers the attacker's source: CONDITIONAL(network_reachability); if a deny assignment or deny Azure Policy covers flexibleServers/write at effective scope (blocking the upstream CanModifyConfiguration): BLOCKED.

Narrative

{principal.name} holds native administrator credentials on {server.name} (via password reset). Combined with network reachability, the attacker can modify any data in any database: INSERT new records, UPDATE existing data, DELETE records, or DROP tables. This enables data poisoning, application compromise, or persistence attacks.

Raw rule rules/derived/azure/postgres-mysql.yaml

id: azure-postgres-mysql-admin-reset-writedata
emits: CanWriteData
description: Admin password reset capability plus network reachability yields full data-plane write access
  (INSERT, UPDATE, DELETE, DROP) on all databases.
match:
- - principal: null
  - CanModifyConfiguration
  - server: null
where:
- node_class(?server) == Data and node_type(?server) == RelationalDatabase
- node_type(?server) matched provider_type in ['Microsoft.DBforPostgreSQL/flexibleServers', 'Microsoft.DBforMySQL/flexibleServers']
- edge produced by azure-postgres-mysql-admin-password-reset (CanModifyConfiguration from flexibleServers/write
  on this server)
emit:
  source_type: Identity
  target_type: RelationalDatabase
  source: ?principal
  target: ?server
  permissions:
  - Microsoft.DBforPostgreSQL/flexibleServers/write
  - Microsoft.DBforMySQL/flexibleServers/write
  conditions:
  - network_reachability
  state_logic: "if ?server.properties.publicNetworkAccess == 'Disabled' (private-access topology / VNet\
    \ injection): CONDITIONAL(network_reachability) \u2014 no public endpoint exists; attacker must have\
    \ a foothold in the delegated subnet or a peered VNet to reach port 5432/3306; elif ?server.properties.publicNetworkAccess\
    \ == 'Enabled' AND a firewall rule admitting the attacker's source IP exists (or rule 0.0.0.0\u2013\
    255.255.255.255): ACTIVE; elif ?server.properties.publicNetworkAccess == 'Enabled' AND no firewall\
    \ rule covers the attacker's source: CONDITIONAL(network_reachability); if a deny assignment or deny\
    \ Azure Policy covers flexibleServers/write at effective scope (blocking the upstream CanModifyConfiguration):\
    \ BLOCKED."
  confidence: '0.89'
  derived_from:
  - 'CanModifyConfiguration edge: source=?principal, target=?server, rule=azure-postgres-mysql-admin-password-reset'
  false_positive_note: "Network reachability is a HARD gate. State logic mirrors CanReadData \u2014 the\
    \ same network and topology rules apply. Native admin credentials grant INSERT, UPDATE, DELETE, DROP\
    \ on all databases. An attacker can inject malicious data, truncate tables, or modify application\
    \ state to achieve persistence or lateral movement."
  narrative: '{principal.name} holds native administrator credentials on {server.name} (via password reset).
    Combined with network reachability, the attacker can modify any data in any database: INSERT new records,
    UPDATE existing data, DELETE records, or DROP tables. This enables data poisoning, application compromise,
    or persistence attacks.'