rage.fail

azure-sf-app-exposes-mi-credential

An MI-enabled SF application leaks a usable credential for its managed identity via the per-node localhost token service environment.

derived azure emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'app': None} ExecutesAs {'mi': None}

where

node_type(?app) == ApplicationPlatform # SF application resource

emit

source	`<serviceFabric application>`
target	`<managed identity assigned to the app>`
conditions	`service_state`

Narrative

SF application {app.name} exposes a credential for its managed identity {mi.name} via the localhost Managed Identity Token Service environment.

Raw rule rules/derived/azure/servicefabric.yaml

id: azure-sf-app-exposes-mi-credential
emits: ExposesCredential
description: An MI-enabled SF application leaks a usable credential for its managed identity via the per-node
  localhost token service environment.
match:
- - app: null
  - ExecutesAs
  - mi: null
where:
- 'node_type(?app) == ApplicationPlatform   # SF application resource'
emit:
  source: <serviceFabric application>
  target: <managed identity assigned to the app>
  permissions: []
  conditions:
  - service_state
  note: 'Companion fact-edge to azure-sf-app-token-service: the application env (IDENTITY_ENDPOINT + per-activation
    IDENTITY_HEADER) exposes credential material for the app MI to any code running in a bound service.'
  false_positive_note: Only fires when the application actually has a managed identity (identity.type
    != None) AND the cluster ManagedIdentityTokenService is enabled. This is the APP MI, distinct from
    any node/VMSS MI.
  narrative: SF application {app.name} exposes a credential for its managed identity {mi.name} via the
    localhost Managed Identity Token Service environment.