services / Azure / Storage table service

The table service of a storage account exposes NoSQL key/value table storage and its control-plane properties (CORS, storage analytics logging/metrics settings). The data-plane holds organizational table data.

Control-plane property reads expose only service configuration, not table data.

Microsoft.​Storage/​storageAccounts/​tableServices/​generateUserDelegationKey/​action

Returns a user delegation key, cryptographic material that can sign user-delegation SAS tokens granting direct data-plane access to table data under a delegated credential, enabling pivot to data access.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links