services / Azure / Container registry

An Azure Container Registry (ACR) resource that stores and serves container images and OCI artifacts (Helm charts, etc.) consumed by clusters and CI/CD pipelines.

The registry backs the image supply chain for one or more applications; its credentials and stored images are sensitive, but control-plane property reads are low-sensitivity.

Microsoft.​ContainerRegistry/​registries/​generateCredentials/​action

Generates and returns scoped token keys/passwords for a registry token, yielding usable credential material that grants repository access and durable, attacker-held authentication to the registry.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Account persistence (BOOST)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links