Azure
Azure-specific misconfigurations that enable data exposure and privilege escalation. Each page includes description, proof steps, and remediation.
In this section
- Public Blob AccessAzure Storage accounts and Blob containers can inadvertently allow anonymous read/list access.
- Managed Identity AbuseManaged Identities (system- or user-assigned) provide tokens to Azure resources via the Instance Metadata Service (IMDS) or platform endpoints.
- AAD App Consent and Role AbuseApplications (enterprise apps/service principals) with excessive Graph or application permissions can read…
- Key Vault MisconfigurationKey Vaults with broad access policies/RBAC, disabled soft delete/purge protection, publicly reachable…
- RBAC Privilege EscalationMisconfigured custom roles or assignments allow users to grant themselves or others higher privileges.
- Function/Kudu ExposureExposed Kudu (SCM) endpoints and misconfigured Azure Functions/App Services can leak source code, app settings…
- NSG Misconfigurations0/0, Internet) expose services to the internet and bypass intended segmentation.
- Logging and Defender GapsMissing diagnostics/activity logs and disabled Microsoft Defender for Cloud plans reduce detection and response capability across Azure resources.
Last updated
