services / Azure / Azure Static Web App

An Azure Static Web App (Static Site) is a managed hosting resource that serves a public-facing static frontend with linked source-repository/CI build configuration and optional managed serverless API (Azure Functions) backend.

Asset hosts a single public-facing web application; its app settings and deployment tokens routinely contain secrets and connection strings, making secret-returning operations effectively credential disclosure.

Microsoft.​Web/​staticSites/​createinvitation/​action

Generates an invitation link granting a chosen set of application roles to a static-site user, enabling privilege escalation and persistent authenticated access to the app's auth system.

Risks

1. Privilege escalation (CRITICAL)
2. Account persistence (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links