Description

Detects Azure custom roles that use wildcard (*) permissions in their action definitions. Using wildcards in role permissions is a security risk as it may grant overly broad access rights, violating the principle of least privilege and potentially allowing unauthorized access to sensitive resources.

Detection Strategy

• Scans Azure custom role definitions in the subscription

• Examines the 'actions' field within each role's permissions

• Reports a vulnerability if any action contains a wildcard character (*)

• Only evaluates roles where role_type is 'CustomRole'