azure-rediscache-listkeys-can-write-data

Retrieving the cache access key via listKeys/action yields full data-plane write of all cached data (SET, DEL, FLUSHDB, CONFIG SET), subject to network reachability of the Redis endpoint.

derived azure emits CanWriteData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Cache`
source	`?principal`
target	`?cache`
permissions	`Microsoft.Cache/redis/listKeys/action`
conditions	`iam_permission` `network_reachability`
state logic	Same network-reachability gate as azure-rediscache-listkeys-can-read-data: if publicNetworkAccess=Disabled and no private reachability: CONDITIONAL(network_reachability); if firewall restricts caller: CONDITIONAL(network_reachability); else ACTIVE. Inherit weakest state from the CanReadCredential contributing edge.

source type

Identity

target type

Cache

source

?principal

target

?cache

permissions

Microsoft.Cache/redis/listKeys/action

conditions

iam_permission network_reachability

state logic

Same network-reachability gate as azure-rediscache-listkeys-can-read-data: if publicNetworkAccess=Disabled and no private reachability: CONDITIONAL(network_reachability); if firewall restricts caller: CONDITIONAL(network_reachability); else ACTIVE. Inherit weakest state from the CanReadCredential contributing edge.

Narrative

{principal.name} can retrieve the access key for {cache.name} and write to all data in the cache. Write-access primitives include SET (value injection), DEL (key removal), FLUSHDB (complete wipe), CONFIG SET (runtime Redis config changes), and LPUSH/RPUSH (queue injection). Session hijacking and cache poisoning are direct impacts.

Raw rule rules/derived/azure/rediscache.yaml

id: azure-rediscache-listkeys-can-write-data
emits: CanWriteData
description: Retrieving the cache access key via listKeys/action yields full data-plane write of all cached
  data (SET, DEL, FLUSHDB, CONFIG SET), subject to network reachability of the Redis endpoint.
match:
- - principal: null
  - CanReadCredential
  - accessKey: null
- - accessKey: null
  - CredentialsFor
  - cache: null
where:
- node_type(?cache) == Cache
- ?cache.provider_type == 'Microsoft.Cache/redis'
- node_type(?accessKey) == AccessKey
emit:
  source_type: Identity
  target_type: Cache
  source: ?principal
  target: ?cache
  permissions:
  - Microsoft.Cache/redis/listKeys/action
  conditions:
  - iam_permission
  - network_reachability
  state_logic: 'Same network-reachability gate as azure-rediscache-listkeys-can-read-data: if publicNetworkAccess=Disabled
    and no private reachability: CONDITIONAL(network_reachability); if firewall restricts caller: CONDITIONAL(network_reachability);
    else ACTIVE. Inherit weakest state from the CanReadCredential contributing edge.'
  confidence: '0.95'
  derived_from:
  - "<CanReadCredential edge_id (principal \u2192 accessKey)>"
  - "<CredentialsFor edge_id (accessKey \u2192 cache)>"
  false_positive_note: "Same guards as azure-rediscache-listkeys-can-read-data. Write access includes\
    \ FLUSHDB (wipe entire cache), CONFIG SET (modify Redis runtime config), and arbitrary key writes\
    \ \u2014 data poisoning, session hijacking, and queue corruption are all in scope. CanWriteData is\
    \ separately emitted from CanReadData to allow queries to distinguish read-only reconnaissance from\
    \ destructive/injection paths."
  narrative: '{principal.name} can retrieve the access key for {cache.name} and write to all data in the
    cache. Write-access primitives include SET (value injection), DEL (key removal), FLUSHDB (complete
    wipe), CONFIG SET (runtime Redis config changes), and LPUSH/RPUSH (queue injection). Session hijacking
    and cache poisoning are direct impacts.'