services / Azure / Load balancer backend address pool

A backend address pool is the set of target addresses (VMs, NICs, or IPs) that an Azure load balancer distributes incoming traffic to.

The backend pool determines where a load balancer forwards traffic; altering its membership can redirect client traffic to attacker-controlled targets or remove legitimate ones.

Microsoft.​Network/​loadBalancers/​backendAddressPools/​join/​action

Joining a backend address pool lets a principal attach a resource (e.g. an attacker-controlled NIC/VM) into the pool it does not otherwise control, placing it behind the load balancer to receive fronted traffic; flagged Not Alertable.

Risks

1. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links