services / Azure / Web App slot functions

Functions deployed to a Web App / Function App deployment slot; this action lists the function access keys that authorize invoking those functions.

Function keys are invocation credentials enabling code execution as the function app.

Microsoft.​Web/​Sites/​slots/​functions/​listSecrets/​action

Returns the secret function keys for a slot's functions, exporting reusable invocation credentials that enable code execution as the app.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links