services / Azure / ExpressRoute ports

ExpressRoute ports (ExpressRoute Direct) are dedicated physical network connectivity resources that provide high-bandwidth private links between an organization's on-premises network and Azure at a peering location.

Production hybrid-connectivity infrastructure supporting a single organizational function; compromise can disrupt or expose private network traffic.

Microsoft.​Network/​expressRoutePorts/​listAuthorizations/​action

Returns ExpressRoute port authorization keys — credential material that lets an attacker provision and peer their own circuits onto the dedicated private network fabric.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Network movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links