Collected research

Escalating from Reader to Contributor in Azure API Management pt II

Christian August Holm Hansen and @Christian August Holm Hansen · Binary Security AS · 5 November 2024

Demonstrates that legacy Azure Resource Manager API versions exposed API Management secrets and an administrative SSO token to users with Reader-level access. The token could be exchanged for control-plane access, turning a low-privilege role into service administration.

Record

Researcher

Christian August Holm Hansen and @Christian August Holm Hansen

Published by

Binary Security AS

Date

5 November 2024

In the archive

• Collected in the 2024 research round

Tags

• azure
• rest-api
• privilege-escalation
• auth-bypass
• cloud
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Christian August Holm Hansen and @Christian August Holm Hansen, first published at the original source. Preserved copies are kept so the citation survives its host.