azure-synapse-ir-write-config
integrationRuntimes/write allows creating or updating integration runtimes; self-hosted IR configuration can point to attacker-controlled infrastructure, causing all pipeline activities routed through that IR to execute on attacker infrastructure.
match (effective permission)
{
"action": "Microsoft.Synapse/workspaces/integrationRuntimes/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | GenericCompute |
| source | <principal> |
| target | <integration runtime (self-hosted)> |
| permissions | Microsoft.Synapse/workspaces/integrationRuntimes/write |
| conditions | service_state |
| state logic | CONDITIONAL(service_state): the attacker can rewrite an integration runtime's configuration (connection string, authentication type, node list). For self-hosted IR, configuration points to attacker-controlled nodes → pipeline activities routed through that IR run on attacker infrastructure. The IR must exist and a pipeline must be configured to use the IR and be triggered for execution. This is a configuration modification, not immediate execution. |
Narrative
{principal.name} can modify integration runtime configuration (Microsoft.Synapse/workspaces/integrationRuntimes/write); a self-hosted IR can be pointed to attacker-controlled infrastructure, causing pipeline activities to execute on that infrastructure.
Raw rule rules/derived/azure/synapse.yaml
id: azure-synapse-ir-write-config
emits: CanModifyConfiguration
description: integrationRuntimes/write allows creating or updating integration runtimes; self-hosted IR
configuration can point to attacker-controlled infrastructure, causing all pipeline activities routed
through that IR to execute on attacker infrastructure.
match_effective_permission:
action: Microsoft.Synapse/workspaces/integrationRuntimes/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: GenericCompute
source: <principal>
target: <integration runtime (self-hosted)>
permissions:
- Microsoft.Synapse/workspaces/integrationRuntimes/write
conditions:
- service_state
state_logic: "CONDITIONAL(service_state): the attacker can rewrite an integration runtime's configuration\
\ (connection string, authentication type, node list). For self-hosted IR, configuration points to\
\ attacker-controlled nodes \u2192 pipeline activities routed through that IR run on attacker infrastructure.\
\ The IR must exist and a pipeline must be configured to use the IR and be triggered for execution.\
\ This is a configuration modification, not immediate execution."
false_positive_note: Only applies to self-hosted integration runtimes (IR type == 'SelfHosted'). Azure-hosted
and AutoResolve IRs cannot be redirected to attacker infrastructure. Applicable only when a self-hosted
IR exists in the workspace AND pipelines are configured to route through it. See also azure-synapse-ir-listkeys
for credential theft via IR auth keys.
narrative: '{principal.name} can modify integration runtime configuration (Microsoft.Synapse/workspaces/integrationRuntimes/write);
a self-hosted IR can be pointed to attacker-controlled infrastructure, causing pipeline activities
to execute on that infrastructure.'