azure-vnet-dns-public-record-write
Write access to public DNS zone record sets lets an attacker create or modify A/CNAME/alias records - enabling DNS hijack, redirect, or dangling-record takeover.
match (effective permission)
{
"action": "Microsoft.Network/dnsZones/*/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | DNS |
| source | <principal> |
| target | <public DNS zone> |
| permissions | Microsoft.Network/dnsZones/*/write |
| state logic | ACTIVE |
Narrative
{principal.name} can write DNS record sets in public zone {target.name} (dnsZones/*/write), enabling DNS hijack, redirect, or creation of dangling records for subdomain takeover.
Raw rule rules/derived/azure/vnet.yaml
id: azure-vnet-dns-public-record-write
emits: CanModifyConfiguration
description: "Write access to public DNS zone record sets lets an attacker create or modify A/CNAME/alias\
\ records \u2014 enabling DNS hijack, redirect, or dangling-record takeover."
match_effective_permission:
action: Microsoft.Network/dnsZones/*/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: DNS
source: <principal>
target: <public DNS zone>
permissions:
- Microsoft.Network/dnsZones/*/write
state_logic: ACTIVE
false_positive_note: DNS Zone Contributor grants write on all record types; custom roles may scope to
specific record types. Public zone record write (dnsZones/*/write) affects public DNS resolution globally.
Do not conflate the capability (CanModifyConfiguration on the zone) with an existing dangling record
(ExposedToInternet from azure-vnet-dns-dangling-takeover).
narrative: '{principal.name} can write DNS record sets in public zone {target.name} (dnsZones/*/write),
enabling DNS hijack, redirect, or creation of dangling records for subdomain takeover.'
derived_from:
- '<effective permission record: dnsZones/*/write>'