services / Azure / API Management tenant settings

The tenant resource of an Azure API Management service represents service-wide configuration: the global (tenant) policy applied to all API traffic, tenant access (git/management) settings, and the configuration git repository used to manage the whole service.

Controls that govern every API in the service instance; the tenant access keys themselves are credential material that grant administrative access to the configuration repository.

Microsoft.​ApiManagement/​service/​tenant/​listSecrets/​action

Returns tenant access information including the primary/secondary access keys used to authenticate to the management/git configuration endpoint, exporting credential material that grants administrative access to the entire service configuration.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links