azure-sf-execute-as-via-app-deploy
Deploy/upgrade an SF app with attacker code + the app runs as an MI => execute as that MI via the localhost token service.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
{'principal': None}
CanModifyCode {'artifactRepo': None}
{'artifactRepo': None} AttachedTo {'cluster': None}
{'app': None} ExecutesAs {'mi': None}
where
node_type(?app) ==
ApplicationPlatform
?artifactRepo is the application type/version + image store (ArtifactRepository) of ?cluster; ?app deploys on ?cluster
?mi.privilege_level >= ?principal.privilege_level # escalation only
optional
Present → upgrade the emitted state; absent → downgrade (not a hard requirement).
{'principal': None}
CanAttachIdentity {'app': None}
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <managed identity> |
| permissions | Microsoft.ServiceFabric/managedclusters/applications/write applicationTypes/versions/write | FabricClient admin |
| state logic | if ?app has an MI and ManagedIdentityTokenService enabled: ACTIVE elif matched(optional[0]): ACTIVE # attacker can attach a privileged MI else: CONDITIONAL(service_state) |
Narrative
{principal.name} can deploy/upgrade {app.name} with attacker code and mint the token of its identity {mi.name} from the localhost token service, executing as {mi.name}.
Raw rule rules/derived/azure/servicefabric.yaml
id: azure-sf-execute-as-via-app-deploy
emits: CanExecuteAs
description: Deploy/upgrade an SF app with attacker code + the app runs as an MI => execute as that MI
via the localhost token service.
match:
- - principal: null
- CanModifyCode
- artifactRepo: null
- - artifactRepo: null
- AttachedTo
- cluster: null
- - app: null
- ExecutesAs
- mi: null
where:
- node_type(?app) == ApplicationPlatform
- ?artifactRepo is the application type/version + image store (ArtifactRepository) of ?cluster; ?app deploys
on ?cluster
- '?mi.privilege_level >= ?principal.privilege_level # escalation only'
optional:
- - principal: null
- CanAttachIdentity
- app: null
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <managed identity>
state_logic: 'if ?app has an MI and ManagedIdentityTokenService enabled: ACTIVE
elif matched(optional[0]): ACTIVE # attacker can attach a privileged MI
else: CONDITIONAL(service_state)
'
conditions_from:
- app: null
- mi: null
permissions:
- Microsoft.ServiceFabric/managedclusters/applications/write
- applicationTypes/versions/write | FabricClient admin
derived_from:
- <CanModifyCode(artifactRepo) edge_id>
- <AttachedTo edge_id>
- <ExecutesAs edge_id>
false_positive_note: Emit only when the APP has a managed identity that out-privileges the caller and
the token service is enabled. Target the APP MI, never the node/VMSS MI. If the app has no MI, deploying
code yields only cluster/data access, not an ARM token.
narrative: '{principal.name} can deploy/upgrade {app.name} with attacker code and mint the token of
its identity {mi.name} from the localhost token service, executing as {mi.name}.'