services / Azure / Front Door

Azure Front Door (classic) is a global edge/CDN application-delivery service that manages public-facing routing rules, frontend endpoints/custom domains, and backend pools.

A public-facing edge/routing layer; write access can hijack or deface traffic for the fronted application.

Microsoft.​Network/​frontDoors/​write

Creating/updating a Front Door lets an attacker alter routing rules, frontend endpoints/custom domains, and backend pools, enabling traffic rerouting (domain takeover), defacement of public content, and manipulation of delivery configuration.

Risks

1. Domain takeover (CRITICAL)
2. Data manipulation (HIGH)
3. Defacement (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links