services / Azure / APIM product subscriptions

An API Management product subscription binds a user/principal to an API product and holds the gateway API keys that authorize calls to the product's published APIs.

Subscriptions are the access-grant + credential construct of the APIM gateway; the keys themselves are credentials, but the subscription entity (without keys) is access-mapping metadata.

Microsoft.​ApiManagement/​service/​workspaces/​subscriptions/​listSecrets/​action

Returns the subscription's primary/secondary API keys, which are usable credentials that let an attacker invoke the product's protected backend APIs as the authorized subscriber.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links