services / Azure / DNS AAAA record set

Azure DNS AAAA record set mapping a hostname to one or more IPv6 addresses within a DNS zone. Controls public name resolution to IPv6 endpoints for the domain.

Write access enables repointing traffic (domain takeover); delete breaks resolution (DoS).

Microsoft.​Network/​dnszones/​AAAA/​write

Creating/replacing the AAAA record set repoints a hostname's IPv6 traffic to attacker-controlled infrastructure, enabling domain takeover, defacement, and routing manipulation.

Risks

1. Domain takeover (CRITICAL)
2. Data manipulation (HIGH)
3. Defacement (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links