services / Azure / ExpressRoute circuit authorizations

An ExpressRoute circuit authorization is a grant (with an associated authorization key) that permits a virtual network gateway to link into a private ExpressRoute circuit, providing hybrid/private connectivity between Azure and on-premises or other networks.

Authorization keys are connection credentials: holding one lets a party peer their own gateway onto the private circuit, so they are sensitive credential material for a single production network function.

Microsoft.​Network/​expressRouteCircuits/​authorizations/​write

Creating/updating an authorization mints a new authorization key an attacker can redeem to link their own gateway/VNet onto the private circuit, granting network movement and establishing a durable connectivity grant.

Risks

1. Data manipulation (HIGH)
2. Account persistence (BOOST)
3. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links