services / Azure / Web Apps slot site extensions

Site (Kudu/SCM) extensions installed on an App Service deployment slot are code modules/tooling that run inside the app's sandbox.

Control-plane configuration of the app's runtime components; invoking Kudu/SCM can enable command execution and content read/write in the app's context.

Microsoft.​Web/​Sites/​slots/​extensions/​Api/​action

Invoking the slot extension (Kudu/SCM) APIs allows command execution, file/content read-write, and deployment in the app's context, running code as the app's managed identity, reading app files/code, and modifying the deployment.

Risks

1. Data exfiltration (CRITICAL)
2. Data manipulation (HIGH)
3. Lateral movement (BOOST)
4. Resource hijacking (MEDIUM)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links