AZ_AVERE_CONTRIBUTOR

Summary

Forestall ACL Alias	AZ_AVERE_CONTRIBUTOR
Azure Alias	Avere Contributor (Azure RBAC)
Affected Object Types	Virtual Machines
Exploitation Certainty	Certain
Azure RBAC Role	Avere Contributor (4f8fab4f-1852-4a58-a46a-8eaf358af14a)

Description

AZ_AVERE_CONTRIBUTOR represents the Azure RBAC Avere Contributor role assignment. This role was designed for managing Avere vFXT clusters but includes dangerous permissions that can be abused against standard Azure VMs.

The critical abuse vector is that this role includes:

• Execute Run Commands on VMs.

• Manage VM extensions which can be used for code execution.

Identification

PowerShell (Az Module)

Connect-AzAccount

# List all Avere Contributor assignments
Get-AzRoleAssignment -RoleDefinitionName "Avere Contributor" |
    Select-Object DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

Azure CLI

# List Avere Contributor assignments
az role assignment list --role "Avere Contributor" -o table

Azure Portal

1. Open Azure Portal -> Subscriptions (or target scope).

2. Go to Access control (IAM) -> Role assignments.

3. Filter by Role = Avere Contributor.

4. Review assignments - note that this role may be assigned for Avere clusters but affects all VMs.

Exploitation

Execute Run Command / Deploy Extension

Avere Contributor includes permissions for VM Run Command and extension deployment. For detailed exploitation techniques, see AZ_EXECUTE_COMMAND.

Mitigation

1. Review and minimize Avere Contributor assignments

   • This role should only be assigned to identities managing Avere vFXT clusters.

   • Scope assignments to specific Avere resources, not subscriptions or resource groups.

2. Enable endpoint protection

   • Deploy EDR solutions to detect post-exploitation activity.

Detection

Use the Azure Portal:

1. Open Azure Portal -> Monitor -> Activity log.

2. Filter by Operation name containing:

   • extensions/write

   • runCommand

3. Review the Initiated by column for unexpected principals with Avere Contributor role.

4. Check the Resource column to identify affected VMs.

5. Open the affected VM and review Extensions + applications, Run command, and Access control (IAM).

References

• https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#avere-contributor

• https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/vmaccess