Logic Apps privilege escalation to root

Published Wed, Mar 9th, 2022


Azure Logic Apps use API Connections to authenticate actions to services. Having Contributor access to an Azure Resource Manager (ARM) API Connection would allow someone to create arbitrary role assignments as the connected user. This was supposed to be limited to actions at the Resource Group level, but an attacker could escape to the Subscription or Root level with a path traversal payload. The root cause of this behavior was that such a payload would meet the Swagger API definition, and it would be resolved by the server, resulting in a request to an unintended scope.

Affected Services

Azure Logic Apps


None required

Tracked CVEs

No tracked CVEs


Disclosure Date
Tue, Mar 1st, 2022
Exploitablity Period
Known ITW Exploitation
Detection Methods
Piercing Index Rating
Discovered by
Josh Magri, NetSPI