just in short. I was playing around a Azure AppService as I wanted to know how secure it is.
I have discovered it is possible (using the regularly deployed application) to write to complete d:\home folder where also the wwwroot and bin folder are placed. Moreover, it is possible to execute written files, such as scripts or binary code (inside dlls) placed under wwwroot over the web, anonymously. Everything is of course limited with the sandbox and permissions of the user under which the IIS (application pool) is running. However, executed code has the same permissions as the application so it is possible to i.e. read/write D:\home, read d:\local, access key vault, access all kind of databases... everything like this anonymously over the internet (impersonated to the account under which the IIS is running).
Of course, in the real world, I assume the vulnerable application is installed and allows to deploy the potentially malicious code there. This can be also a feature of the application (like simple app management for admins).
I have evaluated it as OWASP2010/2013/2017 A.5 configuration vulnerability. Additionally, I have calculated CVSS score as 9.0 (its not possible to take control over the underlying infrastructure as OS or network, otherwise it would be 10).
Would you evaluate this in the same way as I did? i would appreciate answers from people involved in IS, ideally ethical hackers.
If you want to see more you can check here.