services / Azure / Storage File Service Files

Files and folders stored within an Azure Files share inside a storage account. This is the data plane of the file share, holding the actual organizational file data.

Production file shares commonly hold sensitive business documents, application config, and home-directory data; data-plane access grants direct read/write/delete of that content.

Microsoft.​Storage/​storageAccounts/​fileServices/​fileShares/​files/​actassuperuser/​action

Grants file admin/superuser privileges that override per-file ownership and ACLs, escalating to full access over all data in the share and enabling unrestricted exfiltration.

Risks

1. Data escalation (CRITICAL)
2. Data exfiltration (CRITICAL)
3. Privilege escalation (CRITICAL)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links