azure-sf-createworkload-via-attach-mi
Attach a privileged user-assigned MI to a new/controlled SF app and deploy attacker code -> execute as the MI.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
{'principal': None}
CanPassIdentity {'userMI': None}
{'principal': None} CanAttachIdentity {'app': None}
{'principal': None} CanModifyCode {'artifactRepo': None}
{'artifactRepo': None} AttachedTo {'cluster': None}
where
?app deploys on ?cluster; ?artifactRepo is the
ArtifactRepository (image store) of ?cluster
?userMI is the MI the CanAttachIdentity chain attaches to ?app (bound via CanPassIdentity)
?userMI.privilege_level >= ?principal.privilege_level
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <user-assigned managed identity> |
| permissions | Microsoft.ManagedIdentity/userAssignedIdentities/assign/action Microsoft.ServiceFabric/managedclusters/applications/write applicationTypes/versions/write |
| conditions | role_compatibility service_state |
Narrative
{principal.name} can attach user-assigned MI {userMI.name} to an SF app it can deploy code into, executing as {userMI.name}.
Raw rule rules/derived/azure/servicefabric.yaml
id: azure-sf-createworkload-via-attach-mi
emits: CanCreateWorkloadAs
description: Attach a privileged user-assigned MI to a new/controlled SF app and deploy attacker code
-> execute as the MI.
match:
- - principal: null
- CanPassIdentity
- userMI: null
- - principal: null
- CanAttachIdentity
- app: null
- - principal: null
- CanModifyCode
- artifactRepo: null
- - artifactRepo: null
- AttachedTo
- cluster: null
where:
- ?app deploys on ?cluster; ?artifactRepo is the ArtifactRepository (image store) of ?cluster
- ?userMI is the MI the CanAttachIdentity chain attaches to ?app (bound via CanPassIdentity)
- ?userMI.privilege_level >= ?principal.privilege_level
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <user-assigned managed identity>
permissions:
- Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
- Microsoft.ServiceFabric/managedclusters/applications/write
- applicationTypes/versions/write
conditions:
- role_compatibility
- service_state
derived_from:
- <CanPassIdentity edge_id>
- <CanAttachIdentity edge_id>
- <CanModifyCode(artifactRepo) edge_id>
false_positive_note: Requires the pass/attach chain (assign/action + applications/write, i.e. CanPassIdentity(?userMI)
+ CanAttachIdentity(?app)) AND a code-deploy primitive (CanModifyCode on the app's ArtifactRepository).
Escalation only if the attached MI out-privileges the caller. Targets the APP MI plane.
narrative: '{principal.name} can attach user-assigned MI {userMI.name} to an SF app it can deploy code
into, executing as {userMI.name}.'