The article explains how Azure RBAC and ABAC can be analyzed at the permission level to uncover privilege escalation paths, including a built-in role that once allowed arbitrary escalation to Owner. It also describes an undocumented ARM API for mapping permissions to roles, the discovery and remediation of the Anyscale Platform Administrator Role issue, and recommendations for reducing attack surface in Azure. #AzureRBAC #ABAC #AnyscalePlatformAdministratorRole
Keypoints
- Azure has expanded to over 200 services, 897 built-in RBAC roles, and 22,018 permissions, increasing the attack surface.
- ABAC is increasingly used in built-in roles, especially to constrain privileged role assignment actions such as Microsoft.Authorization/roleAssignments/write.
- Reviewing effective permissions, not just roles, helps identify privilege escalation paths more accurately.
- A specific Azure ARM API version, 2023-07-01-preview, can map permissions to roles using the hasAllPermissions filter.
- The authors found a built-in role, Anyscale Platform Administrator Role, that enabled arbitrary privilege escalation to Owner before Microsoft removed the risky permissions.
- The blog classifies escalation paths into categories such as direct RBAC escalation, execution/managed identity access, secrets access, and dependent service control.
- Recommended defenses include tight scoping, workload segmentation, least privilege, and reviewing both RBAC and ABAC conditions before assignment.
MITRE Techniques
- [T1098 ] Account Manipulation – The article describes abusing role assignment permissions to gain higher privileges and create or update access through RBAC changes. (‘use role assignment write to grant roles and escalate privileges’)
- [T1068 ] Exploitation for Privilege Escalation – The blog frames privilege escalation as a core objective and shows how permissions can lead to elevation to Owner. (‘could have allowed arbitrary privilege escalation to Owner’)
- [T1552 ] Unsecured Credentials – Access to Storage Account shared keys is discussed as a path to full data-plane access and unintended compromise. (‘Shared Access Keys allow for full data access’)
- [T1528 ] Steal Application Access Token – Managed identity access and permission-based access to privileged resources are discussed as escalation vectors. (‘access to Managed Identity … enabled resources’)
Indicators of Compromise
- [Role names ] Privileged or notable Azure roles identified in the analysis – Owner, User Access Administrator, Role Based Access Control Administrator, and Anyscale Platform Administrator Role
- [Azure API version ] Undocumented ARM API used to map permissions to roles – 2023-07-01-preview, hasAllPermissions
- [Permission strings ] Privileged Azure permissions discussed as escalation enablers – Microsoft.Authorization/roleAssignments/write, Microsoft.Storage/storageAccounts/listkeys/action
- [GUIDs ] RoleDefinitionId values used in ABAC conditions to constrain role assignment – 8e3af657-a8ff-443c-a75c-2fe8c4bcb635, 18d7d88d-d35e-4fb5-a5c3-7773c20a72d9, and 2 more GUIDs
- [Tool names ] Azure attack-surface and role-mapping tools referenced in the article – AzureHound, ROADRecon, ScEntra, and Cirro