Logic Apps privilege escalation to root

Summary

Azure Logic Apps use API Connections to authenticate actions to services. Having Contributor access to an Azure Resource Manager (ARM) API Connection would allow someone to create arbitrary role assignments as the connected user. This was supposed to be limited to actions at the Resource Group level, but an attacker could escape to the Subscription or Root level with a path traversal payload. The root cause of this behavior was that such a payload would meet the Swagger API definition, and it would be resolved by the server, resulting in a request to an unintended scope.

Affected Services

Azure Logic Apps

Remediation

None required

Tracked CVEs

No tracked CVEs

References

Contributed by https://github.com/mer-b