services / Azure / Storage Queue Service Queues

A storage queue is a named message container within the queue service that holds messages (work items) for asynchronous producer/consumer processing.

Queues carry in-flight operational data and may drive downstream automation; their stored access policies back SAS-token access.

Microsoft.​Storage/​storageAccounts/​queueServices/​queues/​setAcl/​action

Despite the mislabeled 'Process message' display name, the setAcl operation writes the queue's stored access policy, letting an attacker grant or broaden SAS-backed access to the queue (and revoke others' access).

Risks

1. Privilege escalation (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links