azure-sf-app-deploy-code

id: azure-sf-app-deploy-code
emits: CanModifyCode
description: Register an attacker application-type version and create/upgrade an app pointing at it ->
  attacker code runs in the cluster.
match_effective_permission:
  action: Microsoft.ServiceFabric/managedclusters/applications/write
  scope_type: resource|resourceGroup|subscription
where:
- principal ALSO has EFFECTIVE Microsoft.ServiceFabric/managedclusters/applicationTypes/write AND .../applicationTypes/versions/write
  (or .../clusters/* equivalents) to register the code package
emit:
  source_type: Identity
  source: <principal>
  target: <serviceFabric application type/version + image store (ArtifactRepository)>
  permissions:
  - Microsoft.ServiceFabric/managedclusters/applications/write
  - Microsoft.ServiceFabric/managedclusters/applicationTypes/versions/write
  escalation: Deploy or upgrade an SF application whose code package is attacker-controlled; the service
    runs as the app's managed identity.
  false_positive_note: applications/write ALONE (without applicationTypes/versions/write to register a
    code package) can still re-point an existing app to a new version but cannot introduce arbitrary NEW
    code; require both for the 'arbitrary code' claim. On classic .../clusters/* use the clusters/applications/*
    strings. Target is the ArtifactRepository (application type/version + image store, the executable-content
    plane), NOT the ApplicationPlatform/ContainerCluster object which CanModifyCode's schema target set
    (Compute, ContainerRegistry, ArtifactRepository, KubernetesWorkload) excludes.
  narrative: '{principal.name} can register an attacker code package into the application type/version
    image store {target.name} and deploy/upgrade the app (applications/write + applicationTypes/versions/write).'