AZ_CONTRIBUTOR

Summary

Forestall ACL Alias	AZ_CONTRIBUTOR
Azure Alias	Contributor (Azure RBAC)
Affected Object Types	Subscriptions, Resource Groups, VMs, Key Vaults, Automation Accounts, and other ARM resources
Exploitation Certainty	Certain
Azure RBAC Role	Contributor (b24988ac-6180-42a0-ab88-20f7382dd24c) - full resource write access, but cannot assign roles

Description

AZ_CONTRIBUTOR represents the Azure Resource Manager Contributor role assignment. The Contributor role grants almost all abusable privileges in all circumstances, with some exceptions:

• Full management-plane access to the target resource (create, update, delete).

• Cannot assign roles - unlike Owner, the Contributor role does not include Microsoft.Authorization/roleAssignments/write.

• Cannot manage access policies on some resources directly, but can often bypass this through other means.

The Contributor role is highly dangerous because it enables direct abuse of many resource types:

Target Resource	Abuse
Key Vault	Read secrets and alter access policies (grant yourself access to read secrets)
Automation Account	Create/edit runbooks that run as the Automation Account; gather RunAs certificates
Virtual Machine	Run SYSTEM commands on the VM via RunCommand
Web App / Function App	Deploy code, access managed identity tokens
Storage Account	Read/write blobs, tables, queues

Identification

PowerShell (Az Module)

Connect-AzAccount

# List all Contributor role assignments
Get-AzRoleAssignment -RoleDefinitionName "Contributor" |
    Select-Object DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

# List Contributor at a specific scope
Get-AzRoleAssignment -RoleDefinitionName "Contributor" -Scope "/subscriptions/<SubscriptionId>" |
    Select-Object DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

# Check if a specific principal has Contributor
Get-AzRoleAssignment -SignInName "[e-mail]" |
    Where-Object { $_.RoleDefinitionName -eq "Contributor" } |
    Select-Object DisplayName, RoleDefinitionName, Scope |
    Format-Table -AutoSize

Azure Portal

1. Open Azure Portal -> Subscriptions (or the target resource).

2. Go to Access control (IAM) -> Role assignments.

3. Filter by Role = Contributor.

4. Review all principals listed.

Exploitation

The Contributor role grants almost all abusable privileges in all circumstances. Unlike Owner, it cannot assign roles - but it can directly abuse resources at the target scope.

Related Attack Paths:

• AZ_EXECUTE_COMMAND - Contributor on VMs can execute commands as SYSTEM via RunCommand.

• AZ_KEY_VAULT_CONTRIBUTOR - Contributor on Key Vaults can modify access policies to grant data-plane access.

• AZ_GET_SECRETS - After modifying access policies, read Key Vault secrets.

• AZ_GET_KEYS - After modifying access policies, read Key Vault keys.

• AZ_GET_CERTIFICATES - After modifying access policies, read Key Vault certificates.

• AZ_VM_CONTRIBUTOR - Contributor on VMs enables the same VM abuses as VM Contributor.

Mitigation

1. Minimize Contributor assignments

   • Go to Azure Portal -> target resource -> Access control (IAM) -> Role assignments.

   • Filter by Contributor and remove any principal that does not strictly require broad access.

   • Prefer more specific built-in roles (e.g., Reader, Virtual Machine User Login, Key Vault Secrets User).

2. Use Privileged Identity Management (PIM) for just-in-time access

   • Configure eligible (not permanent) assignments for the Contributor role.

   • Require approval and MFA for activation.

3. Scope assignments narrowly

   • Assign Contributor at the resource group or resource level rather than subscription level.

4. Monitor with Azure Policy

   • Use Azure Policy to audit and restrict overly broad role assignments.

Detection

Use the Azure Portal:

1. Open Azure Portal -> Monitor -> Activity log.

2. Filter Operation name for role assignment changes, VM Run Command activity, Key Vault access policy changes, and Automation Account runbook changes.

3. Review Event initiated by, Timestamp, Resource, Status, and Change history for unexpected privileged actions by Contributor identities.

4. Open the affected subscription, resource group, or resource and review Access control (IAM) for current Contributor assignments.

References

• https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#contributor

• https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/

• https://blog.netspi.com/azure-automation-accounts-key-stores/

• https://blog.netspi.com/get-azurepasswords/

• https://blog.netspi.com/attacking-azure-cloud-shell/