azure-sb-topic-sub-triggers-consumer

A confirmed event-source binding from a Service Bus topic subscription to a compute consumer - fan-out trigger fact.

derived azure emits CanTrigger

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Queue`
target type	`Compute`
source	`?subscription`
target	`<compute consumer bound to ?subscription>`
conditions	`trigger_exists` `service_state`
state logic	ACTIVE when the subscription binding is confirmed live. CONDITIONAL( trigger_exists) when binding exists but consumer is stopped or subscription filters block the attacker's payload. Topic subscriptions may have SQL-style filter rules; if the attacker payload cannot satisfy the filter predicate, the trigger is BLOCKED or CONDITIONAL(condition_expression). inherit_weakest with the contributing CanTrigger/CanWriteData from the topic fan-out.

source type

Queue

target type

Compute

source

?subscription

target

<compute consumer bound to ?subscription>

conditions

trigger_exists service_state

state logic

ACTIVE when the subscription binding is confirmed live. CONDITIONAL( trigger_exists) when binding exists but consumer is stopped or subscription filters block the attacker's payload. Topic subscriptions may have SQL-style filter rules; if the attacker payload cannot satisfy the filter predicate, the trigger is BLOCKED or CONDITIONAL(condition_expression). inherit_weakest with the contributing CanTrigger/CanWriteData from the topic fan-out.

Narrative

Service Bus topic subscription {subscription.name} is bound as an event source to consumer {target.name}; messages published to the parent topic that match the subscription filter trigger {target.name} to execute.

Raw rule rules/derived/azure/servicebus.yaml

id: azure-sb-topic-sub-triggers-consumer
emits: CanTrigger
description: "A confirmed event-source binding from a Service Bus topic subscription to a compute consumer\
  \ \u2014 fan-out trigger fact."
match:
- - subscription: null
  - LocatedIn
  - topic: null
where:
- node_type(?subscription) == Queue
- node_type(?topic) == Topic
- a confirmed event-source binding exists routing ?subscription to ?consumer
- the binding is active/enabled
emit:
  source_type: Queue
  target_type: Compute
  source: ?subscription
  target: <compute consumer bound to ?subscription>
  permissions: []
  conditions:
  - trigger_exists
  - service_state
  state_logic: ACTIVE when the subscription binding is confirmed live. CONDITIONAL( trigger_exists) when
    binding exists but consumer is stopped or subscription filters block the attacker's payload. Topic
    subscriptions may have SQL-style filter rules; if the attacker payload cannot satisfy the filter predicate,
    the trigger is BLOCKED or CONDITIONAL(condition_expression). inherit_weakest with the contributing
    CanTrigger/CanWriteData from the topic fan-out.
  confidence: 0.92
  derived_from:
  - event-source binding fact (topic subscription binding)
  - "messaging-chains.yaml: messaging-publish-triggers-consumer (rule 1) \u2014 CanWriteData(p, topic)\
    \ + CanTrigger(sub, consumer) => CanTrigger(p, consumer)"
  false_positive_note: "Topic subscriptions may have SQL-filter or correlation-filter rules that restrict\
    \ which messages reach the subscriber. An attacker who can publish to the topic but whose payload\
    \ does not satisfy the subscription filter will NOT trigger the consumer \u2014 downgrade to CONDITIONAL(condition_expression)\
    \ or BLOCKED. For CanWriteData(principal, topic), note that sending to the TOPIC is sufficient (the\
    \ subscription filter is evaluated server-side); the attacker need only craft a payload that passes\
    \ the filter."
  narrative: Service Bus topic subscription {subscription.name} is bound as an event source to consumer
    {target.name}; messages published to the parent topic that match the subscription filter trigger {target.name}
    to execute.