services / Azure / Traffic Manager nested endpoint

A Traffic Manager nested endpoint is a routing target within a Traffic Manager profile that references a child Traffic Manager profile, used to build hierarchical DNS-based traffic-routing topologies.

Nested endpoints shape the hierarchical routing of a profile's domain traffic; altering them redirects traffic for the public-facing service the profile fronts.

Microsoft.​Network/​trafficManagerProfiles/​nestedEndpoints/​write

Creating/updating a nested endpoint alters which child profile/target receives the profile's DNS traffic, enabling redirection of the profile's domain traffic to attacker-chosen targets and manipulation of routing configuration.

Risks

1. Domain takeover (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links