services / Azure / API Management client applications

A client application is a registered OAuth application identity that consumes/authenticates to APIs published through API Management.

These registrations are credential-bearing application identities; their secrets grant authenticated API access.

Microsoft.​ApiManagement/​service/​clientApplications/​listSecrets/​action

This action returns the client application's secret credentials, allowing an attacker to export usable credential material and impersonate the application to authenticate to protected APIs.

Risks

1. Account takeover (CRITICAL)
2. Cryptographic exfiltration (CRITICAL)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links