azure-sf-admin-client-provision

id: azure-sf-admin-client-provision
emits: CanModifyCode
description: 'Data-plane: an admin client cert/Entra admin can provision an app type and create an application,
  running attacker code.'
where:
- principal possesses a cluster ADMIN client certificate (thumbprint in fabric settings) OR an Entra admin
  client role
- network path to FabricGateway 19000 (or FabricHttpGateway 19080) exists
- ?artifactRepo is the application type/version + image store (ArtifactRepository) AttachedTo/Contains
  ?cluster
emit:
  source_type: Identity
  source: <principal>
  target: <serviceFabric application type/version + image store (ArtifactRepository) on the cluster>
  permissions:
  - FabricClient:ProvisionApplicationType
  - FabricClient:Upload(imagestore)
  - FabricClient:CreateApplication
  - FabricClient:CodePackageControl
  conditions:
  - network_reachability
  - service_state
  false_positive_note: This is DATA-plane authz via the admin client cert, INDEPENDENT of Microsoft.ServiceFabric
    ARM RBAC. Do NOT emit from mere ARM Reader/Contributor without evidence of an admin client cert. A
    USER (read-only) client role cannot provision. Requires network reach to 19000/19080. Target is the
    ArtifactRepository (application type/version + image store), NOT the ContainerCluster object which
    CanModifyCode's schema target set excludes; the ArtifactRepository is AttachedTo the cluster.
  narrative: '{principal.name} holds a cluster admin client certificate and can reach gateway 19000 on
    the cluster; can provision an application type into image store {target.name} and create an application
    (CreateApplication), running attacker code.'