services / Azure / Load balancer backend address pool

A backend address pool is the set of target addresses (VMs, NICs, or IPs) that an Azure load balancer distributes incoming traffic to.

The backend pool determines where a load balancer forwards traffic; altering its membership can redirect client traffic to attacker-controlled targets or remove legitimate ones.

Microsoft.​Network/​loadBalancers/​backendAddressPools/​write

Creating/updating the pool lets an attacker add attacker-controlled backends (receiving client traffic fronted by the load balancer) or remove legitimate backends, enabling traffic redirection/interception and manipulation of which targets serve the service.

Risks

1. Data exfiltration (CRITICAL)
2. Data manipulation (HIGH)
3. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links