azure-sb-exposes-credential
A Service Bus namespace with readable SAS keys exposes its connection-string credential to any principal with listKeys access.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
{'principal': None}
CanReadSecret {'connstr': None}
{'namespace': None} ContainsSecret {'connstr': None}
where
node_type(?namespace) ==
GenericMessaging
node_type(?connstr) == ConnectionString
?connstr is a SAS connection string for ?namespace or one of its queues/topics
emit
| source type | GenericMessaging |
|---|---|
| target type | ConnectionString |
| source | ?namespace |
| target | ?connstr |
| state logic | ACTIVE when CanReadSecret(principal, connstr) is ACTIVE (listKeys confirmed). Inherits state from the contributing CanReadSecret. Not emitted when disableLocalAuth=true. |
Narrative
Service Bus namespace {namespace.name} exposes its SAS connection string {connstr.name} to {principal.name}, who can call listKeys; the connection string is a data-plane credential that bypasses Entra RBAC.
Raw rule rules/derived/azure/servicebus.yaml
id: azure-sb-exposes-credential
emits: ExposesCredential
description: A Service Bus namespace with readable SAS keys exposes its connection-string credential to
any principal with listKeys access.
match:
- - principal: null
- CanReadSecret
- connstr: null
- - namespace: null
- ContainsSecret
- connstr: null
where:
- node_type(?namespace) == GenericMessaging
- node_type(?connstr) == ConnectionString
- ?connstr is a SAS connection string for ?namespace or one of its queues/topics
emit:
source_type: GenericMessaging
target_type: ConnectionString
source: ?namespace
target: ?connstr
permissions: []
conditions: []
state_logic: ACTIVE when CanReadSecret(principal, connstr) is ACTIVE (listKeys confirmed). Inherits
state from the contributing CanReadSecret. Not emitted when disableLocalAuth=true.
confidence: min(contributing_confidences)
derived_from:
- ?principal CanReadSecret ?connstr (azure-sb-namespace-listkeys or queue/topic equivalents)
- ?namespace ContainsSecret ?connstr (azure-sb-namespace-sas-contains)
- 'credential-chains.yaml: ExposesCredential + CredentialsFor => CanImpersonate'
false_positive_note: "This collapses the ContainsSecret + CanReadSecret pair into an explicit ExposesCredential\
\ on the namespace node so that namespace-centric queries surface the credential leak without requiring\
\ a two-hop walk. State inherits from the weakest contributor. Do not emit for read-only ARM enumeration\
\ (authorizationRules/read) \u2014 the key material is only returned by listKeys/action."
narrative: Service Bus namespace {namespace.name} exposes its SAS connection string {connstr.name} to
{principal.name}, who can call listKeys; the connection string is a data-plane credential that bypasses
Entra RBAC.