services / Azure / Virtual network gateway connection shared key

The shared key of a VirtualNetworkGatewayConnection is the IPsec pre-shared key (PSK) credential that authenticates the site-to-site VPN tunnel between the Azure gateway and its peer.

The PSK is the credential securing the VPN tunnel; exporting it lets an attacker impersonate or man-in-the-middle the tunnel and reach the connected network.

Microsoft.​Network/​connections/​sharedKey/​read

Reads the connection's sharedKey sub-resource, returning the IPsec pre-shared credential and enabling export of secret material usable to authenticate, impersonate, or intercept the tunnel.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Network movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links