services / Azure / Virtual Hub

A Virtual Hub is the routing core of an Azure Virtual WAN, terminating branch/VNet connections and holding the route tables that steer traffic across the WAN.

The hub is the central routing point of a Virtual WAN; controlling its routing redirects or intercepts traffic across every connected VNet and branch.

Microsoft.​Network/​virtualHubs/​write

Creating/updating a hub lets an attacker rewrite the WAN routing that steers traffic between connected VNets and branches, redirecting or intercepting flows across the WAN and tampering with routing configuration.

Risks

1. Data exfiltration (CRITICAL)
2. Data manipulation (HIGH)
3. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links