azure-vnet-dns-private-record-write
Write access to private DNS zone record sets lets an attacker create or modify records - enabling DNS hijack or redirect within linked VNets.
match (effective permission)
{
"action": "Microsoft.Network/privateDnsZones/*/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | DNS |
| source | <principal> |
| target | <private DNS zone> |
| permissions | Microsoft.Network/privateDnsZones/*/write |
| state logic | ACTIVE |
Narrative
{principal.name} can write DNS record sets in private zone {target.name} (privateDnsZones/*/write), enabling DNS hijack or redirect within VNets linked to the zone.
Raw rule rules/derived/azure/vnet.yaml
id: azure-vnet-dns-private-record-write
emits: CanModifyConfiguration
description: "Write access to private DNS zone record sets lets an attacker create or modify records \u2014\
\ enabling DNS hijack or redirect within linked VNets."
match_effective_permission:
action: Microsoft.Network/privateDnsZones/*/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: DNS
source: <principal>
target: <private DNS zone>
permissions:
- Microsoft.Network/privateDnsZones/*/write
state_logic: ACTIVE
false_positive_note: Private DNS Zone Contributor grants write on all record types. Private DNS zone
record write only affects name resolution within linked VNets (not public DNS). Do not conflate the
capability (CanModifyConfiguration on the zone) with an existing dangling record (which only applies
to public zones).
narrative: '{principal.name} can write DNS record sets in private zone {target.name} (privateDnsZones/*/write),
enabling DNS hijack or redirect within VNets linked to the zone.'
derived_from:
- '<effective permission record: privateDnsZones/*/write>'