rage.fail

azure-vmss-model-write

derived azure emits CanModifyCode

match (effective permission)

{ "action": "Microsoft.Compute/virtualMachineScaleSets/write", "scope_type": "resource|resourceGroup|subscription|mg" }

emit

source type	`Identity`
source	`<principal>`
target	`<scale set>`
permissions	`Microsoft.Compute/virtualMachineScaleSets/write`
conditions	`service_state`

Narrative

{principal.name} can rewrite the model of {vmss.name} (virtualMachineScaleSets/write) to run attacker code on instances.

Raw rule rules/derived/azure/vmss.yaml

id: azure-vmss-model-write
emits: CanModifyCode
match_effective_permission:
  action: Microsoft.Compute/virtualMachineScaleSets/write
  scope_type: resource|resourceGroup|subscription|mg
emit:
  source_type: Identity
  source: <principal>
  target: <scale set>
  permissions:
  - Microsoft.Compute/virtualMachineScaleSets/write
  conditions:
  - service_state
  escalation: Rewrite the model extensionProfile / osProfile.customData (cloud-init) / userData, then
    reimage or roll upgrade to detonate as the MI.
  false_positive_note: 'Model write is NOT self-detonating: the CanModifyCode edge is CONDITIONAL(service_state)
    until an upgrade/reimage/new-instance applies the changed model. Without a reimage/osRollingUpgrade/start/capacity
    lever (or upgradePolicy.mode=Automatic) it does not run on existing instances. Weaker than extensions/write
    on an auto-upgrade fleet.'
  narrative: '{principal.name} can rewrite the model of {vmss.name} (virtualMachineScaleSets/write) to
    run attacker code on instances.'