services / Azure / Network Virtual Appliance

A Network Virtual Appliance (NVA) is a third-party firewall/router VM appliance that inspects and forwards network traffic in a VNet or Virtual WAN hub.

An NVA sits in the traffic path inspecting/forwarding production traffic; controlling it enables interception, redirection, or disruption of that traffic.

Microsoft.​Network/​networkVirtualAppliances/​write

Creating/updating an NVA lets an attacker reconfigure or replace the appliance sitting in the traffic path, redirecting or mirroring in-flight traffic to attacker-controlled destinations and tampering with the forwarding/inspection configuration.

Risks

1. Data exfiltration (CRITICAL)
2. Data manipulation (HIGH)
3. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links