services / Azure / Virtual network gateway connection shared key

The shared key of a VirtualNetworkGatewayConnection is the IPsec pre-shared key (PSK) credential that authenticates the site-to-site VPN tunnel between the Azure gateway and its peer.

The PSK is the credential securing the VPN tunnel; exporting it lets an attacker impersonate or man-in-the-middle the tunnel and reach the connected network.

Microsoft.​Network/​connections/​sharedKey/​write

Creates or updates the connection's shared key, letting an attacker set a key they control (enabling tunnel impersonation/hijack) or overwrite the existing PSK to break the legitimate peer's authentication (DoS).

Risks

1. Data manipulation (HIGH)
2. Denial-of-service (HIGH)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links