services / Azure / Web Apps Slots Hostname Bindings

Hostname bindings map custom domains/hostnames to an App Service deployment slot, controlling how public traffic is routed to the app.

Microsoft.​Web/​Sites/​slots/​hostnamebindings/​write

Creating/updating a hostname binding lets an attacker route a custom domain/subdomain to a slot they control, enabling domain takeover and defacement of public-facing content.

Risks

1. Domain takeover (CRITICAL)
2. Defacement (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links