services / Azure / APIM product subscriptions

APIM product subscriptions, which bind a user/principal to a product and carry the primary/secondary subscription keys used to authenticate calls to the product's APIs through the gateway.

Subscription keys are bearer credentials granting authorized access to backend APIs; the subscription entity itself (without keys) is access-grant configuration.

Microsoft.​ApiManagement/​service/​subscriptions/​listSecrets/​action

Returns the subscription's primary and secondary keys — bearer credentials an attacker can replay to authenticate to and invoke the product's protected backend APIs as the subscriber.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links