services / Azure / Web App settings (application settings)

A Web App's application settings: the environment-variable configuration injected into the app, which routinely holds connection strings, storage account keys, API keys, and other credentials.

The ARM management API returns these values in cleartext; they commonly contain credentials enabling access to backing data stores and services.

Microsoft.​Web/​Sites/​config/​appsettings/​read

Reading app settings returns the cleartext environment variables, exporting secret material (connection strings, account keys, API keys) usable for lateral movement into backing services.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links