azure-sb-networkruleswrite-modifycfg

id: azure-sb-networkruleswrite-modifycfg
emits: CanModifyConfiguration
description: Write access to the namespace network rule set allows disabling the default deny action or
  removing IP/VNet filters, opening the data-plane to previously blocked sources.
match_effective_permission:
  action: Microsoft.ServiceBus/namespaces/networkRuleSets/write
  scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds networkRuleSets/write at the namespace scope
- the namespace has a non-trivially restrictive network rule set (defaultAction=Deny with IP or VNet rules,
  OR publicNetworkAccess=Disabled)
emit:
  source_type: Identity
  target_type: GenericMessaging
  source: <principal>
  target: <Service Bus namespace>
  permissions:
  - Microsoft.ServiceBus/namespaces/networkRuleSets/write
  conditions: []
  state_logic: "ACTIVE when the write action is confirmed and the current network rule set is restrictive\
    \ (either defaultAction=Deny or publicNetworkAccess=Disabled). The attacker can set defaultAction=Allow\
    \ to open the namespace to all IPs, or add their source IP to the allowed list. Only meaningful when\
    \ the network rules actually restrict access; if the namespace is already publicly open (defaultAction=Allow),\
    \ this edge adds no attack value \u2014 do not emit. BLOCKED if a deny assignment covers networkRuleSets/write."
  confidence: 0.85
  derived_from:
  - 'effective permission: Microsoft.ServiceBus/namespaces/networkRuleSets/write'
  - 'can-execute-as.yaml: execute-as-via-config-identity-swap (CanModifyConfiguration unlocking a previously
    gated path)'
  false_positive_note: "Only emit when the network rule set is meaningfully restrictive and the attacker\
    \ does not already have network access. If the namespace is publicly open (defaultAction=Allow with\
    \ no IP restrictions), modifying the network rule set provides no additional attack surface. If publicNetworkAccess=Disabled\
    \ (private-endpoint-only mode), this write can re-enable public access \u2014 high-value in that case.\
    \ Do not equate networkRuleSets/write with data-plane access; it only modifies the network filter,\
    \ not RBAC or SAS rules."
  narrative: '{principal.name} can modify the network rule set of Service Bus namespace {target.name}
    (networkRuleSets/write); by setting defaultAction=Allow or adding their IP to the allow list, the
    attacker opens the data-plane AMQP endpoint to their network location, bypassing network-level restrictions.'