services / Azure / API Management self-hosted gateways

A self-hosted gateway is a containerized API Management gateway registered with an APIM service instance that proxies and applies policies to API traffic for backend services, deployable outside Azure.

Gateways front a single API surface/function; their keys and tokens are connection credentials, and their configuration can embed backend secrets and named values.

Microsoft.​ApiManagement/​service/​gateways/​generateToken/​action

Issues a Shared Access Authorization Token for the gateway, returning a directly usable bearer credential that lets an attacker authenticate as the gateway and intercept or route its traffic.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links