services / Azure / ExpressRoute circuit authorizations

An ExpressRoute circuit authorization is a grant (with an associated authorization key) that permits a virtual network gateway to link into a private ExpressRoute circuit, providing hybrid/private connectivity between Azure and on-premises or other networks.

Authorization keys are connection credentials: holding one lets a party peer their own gateway onto the private circuit, so they are sensitive credential material for a single production network function.

Microsoft.​Network/​expressRouteCircuits/​authorizations/​listKeys/​action

A listKeys-style action returning the secret authorization key — credential material an attacker redeems to peer their own gateway onto the private circuit.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Network movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links