services / Azure / DNS CNAME record set

An authoritative DNS CNAME record set within an Azure public DNS zone. A CNAME aliases a hostname to a canonical target name.

DNS record data is published and resolvable by design (public); CNAME aliases pointing at deprovisioned targets are the classic dangling-subdomain-takeover vector.

Microsoft.​Network/​dnszones/​CNAME/​delete

Deleting the CNAME record set breaks resolution for the aliased subdomain (DoS).

Risks

1. Network destruction (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links