services / Azure / Web Apps Functions Host system keys

Functions host system keys are credential material that authenticate calls to the Azure Functions host's admin and extension endpoints (including the master-level admin key) for a function app deployment slot.

These keys are high-privilege authentication credentials scoped to a single function app/slot; possessing them grants invocation and admin access to that function host.

Microsoft.​Web/​Sites/​slots/​host/​systemkeys/​write

Setting/overwriting host system keys lets an attacker plant a known credential value for durable backdoor access (persistence:account) and use it to invoke functions and privileged admin/extension endpoints as the function app identity (escalation:lateral), while altering the security-sensitive auth-key configuration (impact:manipulation).

Risks

1. Data manipulation (HIGH)
2. Account persistence (BOOST)
3. Lateral movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links