services / Azure / Web Apps slot function keys

Function keys are per-function bearer credentials that authorize invocation of an HTTP-triggered function in an App Service Functions slot.

Credential material gating function invocation; the invoked function runs under the app's assigned managed identity.

Microsoft.​Web/​Sites/​slots/​functions/​keys/​write

PUT creates/overwrites a function key with an attacker-chosen value and returns the resolved key, planting a persistent invocation credential and granting durable access to run the function as the app identity.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Data manipulation (HIGH)
3. Account persistence (BOOST)
4. Lateral movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links