services / Azure / Web App deployment slot

An Azure App Service deployment slot is a live, addressable instance of a web/function/Logic App hosting application code, configuration (app settings, connection strings), and an assigned managed identity. Slots can be swapped into the production endpoint.

Slots host a single organizational function's production or staging workload; their configuration and managed identity make them a pivot point for code execution and lateral movement.

Microsoft.​Web/​Sites/​slots/​listworkflowsconnections/​action

Listing a Logic App's connections by ID returns connection runtime objects that can include connection keys/secrets used to authenticate to backend services, disclosing usable credential material for downstream pivot.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links