T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:37
- Finding
- Excessive Subscription-Wide Azure RBAC Recommendation## Vulnerability Details **File Location**: `SKILL.md`, lines 37–43 **Vulnerability Type**: Least-privilege violation through excessive Azure RBAC guidance **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown **Minimum required Azure RBAC role to run the CLI commands above (read-only):** ```json { "role": "Network Contributor", "scope": "Subscription", "note": "Use 'Reader' role at minimum; 'Network Contributor' for effective rules query" } ``` ``` ### Technical Analysis The Skill describes itself as instruction-only and read-only, but recommends assigning the write-capable `Network Contributor` role at subscription scope. This role can manage Azure network resources and therefore grants substantially more authority than a passive audit ordinarily requires. The recommendation conflicts with the Skill metadata (`permissions: read-only`) and weakens least-privilege boundaries. Even though the accompanying note mentions `Reader`, the structured prerequisite identifies `Network Contributor` at `Subscription` scope as the role to grant. The guidance could consequently lead users to provide broad network-management privileges to a human or service identity used only for auditing. ### Attack Path 1. A user follows the Skill's prerequisite guidance before running the audit. 2. The user assigns `Network Contributor` to an audit identity at subscription scope. 3. That identity, its local environment, or its authentication session is compromised or misused. 4. The attacker uses the excessive role to modify network resources, including security controls within the assigned subscription. 5. The attacker can weaken network restrictions, expand resource exposure, or disrupt connectivity. The Skill does not itself perform this attack or request credentials; exploitation depends on a user granting the recommended role and the resulting identity being misused or compromised. ### Impact Assessment The ex ...[truncated 466 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the subscription-wide `Network Contributor` recommendation with `Reader` wherever the required exports can be obtained using read-only access. 2. If an effective-rules operation requires permissions not included in `Reader`, define a custom audit role containing only the specific required read or action permissions, such as narrowly selected `Microsoft.Network/*/read` permissions and the minimum effective-rule action. 3. Scope the role assignment to the relevant NIC, NSG, resource group, or other smallest supported scope instead of the entire subscription. 4. Clearly separate mandatory read-only permissions from optional operations that require additional access. 5. State that `Network Contributor` is not a minimum read-only role and should not be granted solely for this audit. 6. Use a temporary, dedicated audit identity and remove any elevated assignment immediately after the narrowly justified operation. 7. Update the prerequisite example to reflect the Skill's declared read-only security model.