services / Azure / Network Interface join

Joins a virtual machine to a network interface, attaching that NIC (and its IP configuration/subnet placement) to the VM.

Controls which VMs can be attached into the network segment reachable via this NIC's subnet.

Microsoft.​Network/​networkInterfaces/​join/​action

Holding join rights on a NIC scoped to a shared or sensitive subnet lets an attacker attach an attacker-controlled VM's NIC into that network segment, gaining lateral network access. Not Alertable.

Risks

1. Lateral movement (BOOST)
2. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links