services / Azure / Virtual network gateway

An Azure Virtual Network Gateway provides VPN (site-to-site / point-to-site) and ExpressRoute connectivity between an Azure VNet and on-premises or remote networks. It is the production network ingress/egress edge for hybrid connectivity.

A gateway is the trust boundary for a single VNet's hybrid/remote connectivity; control of it can expose or sever access to an entire private network and its hosted services.

Microsoft.​Network/​virtualNetworkGateways/​write

Creating or updating the gateway lets an attacker reconfigure routing, VPN, or IPsec/BGP settings, redirecting or exposing traffic between Azure and the connected on-prem/remote network to an attacker-controlled endpoint.

Risks

1. Data manipulation (HIGH)
2. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links