azure-sb-authruleswrite-modifycfg

id: azure-sb-authruleswrite-modifycfg
emits: CanModifyConfiguration
description: "Write access to Service Bus authorization rules allows creating a new Send-capable SAS rule,\
  \ then calling listKeys to extract a connection string \u2014 a two-step credential escalation."
match_effective_permission:
  any_of:
  - action: Microsoft.ServiceBus/namespaces/authorizationRules/write
    scope_type: resource|resourceGroup|subscription
  - action: Microsoft.ServiceBus/namespaces/queues/authorizationRules/write
    scope_type: resource|resourceGroup|subscription|queue
  - action: Microsoft.ServiceBus/namespaces/topics/authorizationRules/write
    scope_type: resource|resourceGroup|subscription|topic
where:
- principal effectively holds the authorizationRules/write action at the relevant scope
emit:
  source_type: Identity
  target_type: GenericMessaging
  source: <principal>
  target: <Service Bus namespace (GenericMessaging)>
  permissions:
  - Microsoft.ServiceBus/namespaces/authorizationRules/write
  - Microsoft.ServiceBus/namespaces/queues/authorizationRules/write
  - Microsoft.ServiceBus/namespaces/topics/authorizationRules/write
  conditions: []
  state_logic: 'ACTIVE when the write action is confirmed. The attacker can create a new auth rule with
    arbitrary rights (Send/Listen/Manage) and then call listKeys on it (if they also hold listKeys/action)
    or wait for the rule''s connection string to be used. Pairing this CanModifyConfiguration with azure-sb-namespace-listkeys
    (CanReadSecret) gives the full two-step escalation: write a Send rule, call listKeys, send messages,
    trigger consumers. BLOCKED if a deny assignment covers authorizationRules/write.'
  confidence: 0.95
  derived_from:
  - 'effective permission: Microsoft.ServiceBus/namespaces/authorizationRules/write (or queue/topic equivalent)'
  - 'can-execute-as.yaml: execute-as-via-config-identity-swap pattern (config change enabling CanReadSecret)'
  false_positive_note: "authorizationRules/write alone does NOT grant the new rule's connection string\
    \ \u2014 the attacker still needs listKeys/action to extract it. Without listKeys, the created rule's\
    \ key is inaccessible from ARM read. However, if the attacker already holds listKeys/action at the\
    \ namespace scope, creating a new rule with Send rights and calling listKeys completes the credential\
    \ escalation in two steps. Model this as CanModifyConfiguration \u2192 CanReadSecret chain (not a\
    \ direct CanReadSecret). If the namespace has disableLocalAuth=true, newly created auth rules are\
    \ non-functional \u2014 downgrade to POTENTIAL or do not emit."
  narrative: '{principal.name} can create or overwrite Service Bus authorization rules (authorizationRules/write);
    by creating a new rule with Send rights and calling listKeys, the attacker obtains a SAS connection
    string that grants data-plane send access without existing Entra RBAC on the data plane.'