services / Azure / Virtual Machines

An Azure virtual machine: a production compute resource running an OS, applications, attached disks, network interfaces, and optionally a managed identity.

A VM typically supports a single organizational function; control-plane and data-plane access to it can expose on-disk data, attached managed-identity credentials, and the hosted service's availability.

Microsoft.​Compute/​virtualMachines/​attachDetachDataDisks/​action

Attaching a data disk to an attacker-controlled VM exposes its data for exfiltration, while detaching disks removes storage from the source VM, causing data loss and service disruption.

Risks

1. Data destruction (CRITICAL)
2. Data exfiltration (CRITICAL)
3. Denial-of-service (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links