services / Azure / DNS CNAME record set

An authoritative DNS CNAME record set within an Azure public DNS zone. A CNAME aliases a hostname to a canonical target name.

DNS record data is published and resolvable by design (public); CNAME aliases pointing at deprovisioned targets are the classic dangling-subdomain-takeover vector.

Microsoft.​Network/​dnszones/​CNAME/​write

Creating/replacing the CNAME alias repoints a subdomain to attacker-controlled infrastructure, the classic subdomain-takeover and traffic-interception primitive that also enables defacement of the public-facing endpoint.

Risks

1. Domain takeover (CRITICAL)
2. Data manipulation (HIGH)
3. Defacement (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links