services / Azure / DNS zone

An Azure public DNS zone is the authoritative DNS hosting resource for a domain or subdomain, containing the record sets that resolve names for that namespace.

Control over a DNS zone governs name resolution for the domain and thus traffic destination for every service under it.

Microsoft.​Network/​dnszones/​write

Create-or-update lets an attacker provision or control the authoritative zone for a domain, enabling control over how that domain/subdomain is resolved (domain takeover) and manipulation of zone configuration; note this operation alters only zone-level properties/tags, not the record sets (a separate operation).

Risks

1. Domain takeover (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links