services / Azure / Web Apps slot Functions host function keys

Functions host function keys are app-level bearer credentials valid for invoking any function across the function app slot.

Credential material gating app-wide function invocation; invoked functions run under the app's assigned managed identity.

Microsoft.​Web/​Sites/​slots/​host/​functionkeys/​write

PUT creates/overwrites a host-level function key with an attacker-chosen value and returns the resolved key, planting a persistent credential valid across all functions in the app and granting invocation as the app identity.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Data manipulation (HIGH)
3. Account persistence (BOOST)
4. Lateral movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links