services / Azure / Storage account

An Azure Storage account is a primary production data store holding blobs, files, queues, and tables, with control-plane configuration for networking, encryption, access keys, and custom domains.

Storage accounts back a single organizational function's data; their access keys and SAS tokens are full-control data-plane credentials, making key/SAS-returning operations effectively account-takeover primitives.

Microsoft.​Storage/​storageAccounts/​listKeys/​action

Returns the account access keys, full-control credentials granting complete data-plane access to all data and usable as a standalone identity.

Risks

1. Account takeover (CRITICAL)
2. Cryptographic exfiltration (CRITICAL)
3. Data exfiltration (CRITICAL)
4. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links