services / Azure / Key Vault certificate issuer

A certificate issuer (certificatecas) is a data-plane object in a Key Vault that stores the configuration and CA account credentials used to enroll and renew certificates through an external certificate authority (e.g. DigiCert, GlobalSign).

The issuer holds CA account credentials (account ID and API key/password) and controls how trusted certificates are minted for dependent services; it lives in the CRITICAL-sensitivity Key Vault data plane.

Microsoft.​KeyVault/​Vaults/​certificatecas/​write

Writing the certificate issuer lets an attacker create or repoint the CA configuration (including attacker-controlled CA credentials/endpoint), tampering with how certificates are issued and establishing a foothold to mint trusted certificates for persistence.

Risks

1. Data manipulation (HIGH)
2. Account persistence (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links