services / Azure / Virtual network gateway

An Azure Virtual Network Gateway provides VPN (site-to-site / point-to-site) and ExpressRoute connectivity between an Azure VNet and on-premises or remote networks. It is the production network ingress/egress edge for hybrid connectivity.

A gateway is the trust boundary for a single VNet's hybrid/remote connectivity; control of it can expose or sever access to an entire private network and its hosted services.

Microsoft.​Network/​virtualNetworkGateways/​setvpnclientipsecparameters/​action

Sets the IPsec/IKE cipher, integrity, and lifetime parameters used by the gateway's P2S VPN clients. An attacker can downgrade these to weak/deprecated algorithms, enabling interception or decryption of P2S client traffic into the private network.

Risks

1. Network movement (BOOST)
2. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links