services / Azure / Private DNS AAAA record set

An AAAA record set maps internal hostnames to IPv6 addresses within an Azure Private DNS zone, used for name resolution inside linked virtual networks.

Private (internal) records, not public-facing; supports a single organizational network function.

Microsoft.​Network/​privateDnsZones/​AAAA/​write

Creating/updating the record set replaces internal hostname-to-IPv6 mappings, letting an attacker repoint internal names to attacker-controlled addresses to route/intercept traffic within the private zone.

Risks

1. Domain takeover (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links