services / Azure / Cosmos DB SQL role assignment

A Cosmos DB native (SQL API) data-plane RBAC role assignment binding a principal to a SQL role definition at a scope within a database account.

Access-control binding governing which identities can read and write the production database's data plane; creating/deleting these directly controls data access.

Microsoft.​DocumentDB/​databaseAccounts/​sqlRoleAssignments/​write

Creating/updating a SQL role assignment binds a controlled principal or managed identity to a data-plane role, the headline primitive that grants the attacker (or another identity) read/write access to the database, enables lateral movement, and establishes durable access.

Risks

1. Privilege escalation (CRITICAL)
2. Account persistence (BOOST)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links