services / Azure / Storage File Service Files

Files and folders stored within an Azure Files share inside a storage account. This is the data plane of the file share, holding the actual organizational file data.

Production file shares commonly hold sensitive business documents, application config, and home-directory data; data-plane access grants direct read/write/delete of that content.

Microsoft.​Storage/​storageAccounts/​fileServices/​fileShares/​files/​modifyPermissions/​action

Modifies the NTFS/file ACL, letting an attacker grant themselves additional access to file data and revoke or deny legitimate users' access.

Risks

1. Privilege escalation (CRITICAL)
2. Denial-of-access (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links