services / Azure / Virtual network gateway connection

The shared key of a VirtualNetworkGatewayConnection is the IPsec pre-shared key (PSK) credential that authenticates the site-to-site VPN tunnel between the Azure gateway and its peer.

The PSK is the credential securing the VPN tunnel; exporting it lets an attacker impersonate or man-in-the-middle the tunnel and reach the connected network.

Microsoft.​Network/​connections/​sharedKey/​action

Despite the /action naming, this GET returns the connection's IPsec pre-shared key (credential material), enabling exfiltration of the secret and, by reuse, establishing/impersonating the tunnel to reach the connected network.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Network movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links