services / Azure / DNS Alias of a Public IP Address

A DNS alias of a public IP address binds a publicly resolvable DNS name/FQDN to an Azure public IP, controlling how that name routes to the endpoint.

Controls public-facing DNS routing; write/delete enable domain/subdomain takeover and defacement of public-facing assets.

Microsoft.​Network/​publicIPAddresses/​dnsAliases/​delete

Deleting the DNS alias removes the name-to-IP binding, breaking resolution of the public endpoint (DoS) and freeing the name to be re-claimed and re-pointed for a dangling-DNS subdomain takeover.

Risks

1. Domain takeover (CRITICAL)
2. Denial-of-service (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links