services / Azure / Application security group

An Application Security Group (ASG) is a logical grouping of network interfaces (by application role) that can be referenced as the source/destination of NSG rules, instead of explicit IP ranges, to scope firewall rules to a set of VMs.

An ASG is a perimeter/segmentation control referenced by NSG rules; membership in one determines which firewall rules apply to a given interface, so misuse indirectly controls network access the same way an NSG does. Rated consistent with the other network-segmentation resources documented alongside it.

Microsoft.​Network/​applicationSecurityGroups/​joinNetworkSecurityRule/​action

Azure requires this permission on the ASG itself before a principal can reference it as the source/destination of an NSG security rule, specifically so that a principal with only narrow rule-authoring rights cannot silently scope a rule to a group they don't control. Holding join lets an attacker wire an attacker-controlled ASG into a security rule (or wire a sanctioned ASG into an attacker-authored rule) to open or evade intended firewall segmentation.

Risks

1. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links