services / Azure / APIM product subscriptions

APIM product subscriptions, which bind a user/principal to a product and carry the primary/secondary subscription keys used to authenticate calls to the product's APIs through the gateway.

Subscription keys are bearer credentials granting authorized access to backend APIs; the subscription entity itself (without keys) is access-grant configuration.

Microsoft.​ApiManagement/​service/​subscriptions/​write

Creating/updating a subscription provisions a keyed access credential for a chosen user to a product, granting (and persisting) authorized access to the product's protected APIs and altering subscription state.

Risks

1. Privilege escalation (CRITICAL)
2. Data manipulation (HIGH)
3. Account persistence (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links