services / Azure / Web App

An Azure App Service site (Web App, Function App, or Logic App Standard) is a managed hosting resource that runs an organization's application code, often with an attached managed identity, app settings/connection strings, and a public-facing endpoint.

Production application hosting for a single organizational function; can hold secrets in app settings, run code under a managed identity, and serve public traffic.

Microsoft.​Web/​Sites/​newpassword/​action

Regenerating the app-scope deployment password sets a new publishing credential the attacker controls, establishing persistent code-deployment access and execution as the app identity; the action sets/rotates rather than returning an existing secret.

Risks

1. Account persistence (BOOST)
2. Lateral movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links