services / Azure / Load balancer backend address pool

A backend address pool is the set of target addresses (VMs, NICs, or IPs) that an Azure load balancer distributes incoming traffic to.

The backend pool determines where a load balancer forwards traffic; altering its membership can redirect client traffic to attacker-controlled targets or remove legitimate ones.

Microsoft.​Network/​loadBalancers/​backendAddressPools/​updateAdminState/​action

Updates the admin state of backend addresses, letting an attacker forcibly mark legitimate backends down so the load balancer stops forwarding to them, denying service.

Risks

1. Denial-of-service (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links