services / Azure / Azure Automation Source Control

An Azure Automation source control links the account to a Git repository (GitHub/Azure DevOps) whose code is synced into runbooks that execute under the account's identity, authenticated by a stored access token.

The stored access token (PAT/OAuth) is never returned on a normal read; the read exposes only the linkage configuration.

Microsoft.​Automation/​automationAccounts/​sourceControls/​write

Creating/updating a source control can repoint runbook sync at an attacker-controlled repo, injecting code (manipulation) that executes under the account identity (lateral movement) and delivers attacker-controlled code persistently.

Risks

1. Data manipulation (HIGH)
2. Account persistence (BOOST)
3. Lateral movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links