services / Azure / Disk snapshots

An Azure snapshot is a read-only point-in-time copy of a managed disk; it captures the complete filesystem contents of the source disk including any OS credentials, application data, and secrets present at capture time.

A snapshot is a full copy of a single workload's disk data, often used for backup/recovery. SAS-based access to its raw bytes bypasses VM-level access controls.

Microsoft.​Compute/​Snapshots/​download/​action

Data-plane read over the snapshot SAS URI streams the full raw snapshot contents, a complete point-in-time copy of the source disk's data, directly exfiltrating it.

Risks

1. Data exfiltration (CRITICAL)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links