services / Azure / Container App

An Azure Container App is a serverless container hosting resource that runs application workloads, with configuration covering the container image, ingress, scaling, environment variables, secrets, and assigned managed identities.

Production compute supporting a single application function; can hold secrets and managed identities that authenticate to backing services.

Microsoft.​Web/​containerApps/​listSecrets/​action

This listSecrets action returns the app's secret values in cleartext, directly exfiltrating credential material and enabling lateral movement into the services those credentials authenticate to.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links