Skip to content

Correct API Management SSO source link #500

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
carlospolop wants to merge 1 commit into from
Closed

Correct API Management SSO source link #500

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions ...sting-cloud/azure-security/az-privilege-escalation/az-api-management-privesc.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,14 +12,16 @@ For more information about API Management access:

The permission strings below are Azure RBAC operations for the `Microsoft.ApiManagement` resource provider. Their documented effects are used to distinguish read, secret-retrieval, write, and network-configuration capabilities.<sup>[[1]](#references)</sup>

## `Microsoft.ApiManagement/service/users/token/action`
## `Microsoft.ApiManagement/service/users/generateSsoUrl/action`

**Minimum permissions:** `Microsoft.ApiManagement/service/users/token/action`
**Minimum permissions:** `Microsoft.ApiManagement/service/users/generateSsoUrl/action` on the selected user.

**Potential Impact:** Generates an SSO URL with a token that logs in as a chosen developer-portal user, inheriting that user's API subscriptions and portal visibility (not an Azure control-plane token; unavailable on Consumption tier).

On tiers with developer users, this operation generates an SSO URL containing a token that signs in as the selected developer-portal user:

`Microsoft.ApiManagement/service/users/token/action` is a separate operation that retrieves a shared access token.

```bash
az rest --method POST \
--url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ApiManagement/service/<service>/users/<user-id>/generateSsoUrl?api-version=2022-08-01"
Expand Down
2 changes: 1 addition & 1 deletion src/privilege-escalation-paths/azure/adjacent_principals.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
provider: azure
service: api_management
title: Sign in as one named API Management developer-portal user
source: src/pentesting-cloud/azure-security/az-privilege-escalation/az-api-management-privesc.md#microsoftapimanagementserviceuserstokenaction
source: src/pentesting-cloud/azure-security/az-privilege-escalation/az-api-management-privesc.md#microsoftapimanagementserviceusersgeneratessourlaction
source_revision: db5b136660
summary: A generated SSO URL can reach the exact requested portal user only when its token is usable and newly grants a named portal or subscription action.
requires:
Expand Down
Loading