services / Azure / Traffic Manager external endpoint

A Traffic Manager external endpoint is a routing target (an external FQDN/IP outside Azure) within a Traffic Manager profile that DNS-based load balancing directs end-user traffic to.

Endpoints determine where a profile's domain traffic is routed; altering them redirects traffic for the public-facing service the profile fronts.

Microsoft.​Network/​trafficManagerProfiles/​externalEndpoints/​write

Creating/updating an external endpoint repoints the profile's DNS-based traffic to an attacker-controlled target, hijacking traffic on the profile's domain and manipulating production routing configuration.

Risks

1. Domain takeover (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links