services / Azure / DNS NS record set

An authoritative DNS NS record set within an Azure public DNS zone. NS records delegate authority for the zone or a child subdomain to a set of nameservers.

DNS record data is published and resolvable by design (public); NS delegation control hands full authoritative control over an entire namespace subtree.

Microsoft.​Network/​dnszones/​NS/​write

Creating/replacing NS records re-delegates a (sub)zone to attacker-controlled nameservers, handing the attacker full authoritative control over all names beneath that delegation — the strongest DNS-takeover primitive.

Risks

1. Domain takeover (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links