services / Azure / Garnet cluster (Redis-compatible cache)

Microsoft DocumentDB Garnet clusters are a Redis-compatible in-memory cache/data store. The acl child resource scopes data-plane commands executed against the cluster keyspace and pub/sub system.

Holds cached organizational data and carries application pub/sub message streams; treated as a production data store supporting a single function.

Microsoft.​DocumentDB/​garnetClusters/​acl/​scriptevalsha/​action

EVALSHA executes a previously loaded script by its SHA with the same full read/modify/delete reach over the keyspace as EVAL.

Risks

1. Data destruction (CRITICAL)
2. Data exfiltration (CRITICAL)
3. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links