services / Azure / Virtual network subnet

A subnet is a segment of a virtual network's address space, used to isolate groups of resources and as the attachment point for NSGs, route tables, service endpoints, and delegated services.

Subnets are the unit of network segmentation within a VNet; control-plane privileges on it — altering address ranges, NSG/route-table associations, delegations, or attaching unauthorized resources into it — can enable significant privilege escalation via lateral network access (per the CRITICAL definition in services/README.md).

Microsoft.​Network/​virtualNetworks/​subnets/​join/​action

Azure requires this permission on the subnet before a principal may attach a new resource (e.g. a VM NIC) into it, specifically to stop principals with only resource-create rights from freely attaching into subnets they don't otherwise control. Holding join therefore lets an attacker deploy attacker-controlled resources directly into a specific, potentially sensitive subnet, bypassing the intended segmentation boundary and gaining network-level access to everything else on that subnet.

Risks

1. Lateral movement (BOOST)
2. Network movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links