services / Azure / Azure VPN gateway

A VpnGateway is an Azure Virtual WAN site-to-site VPN gateway resource that provides cross-premises/hybrid network connectivity, including VPN connections, BGP routing, and IP configuration.

Production network connectivity infrastructure for a single organizational function (hybrid/site-to-site connectivity); compromise can extend reach into peered/on-prem networks or sever connectivity.

Microsoft.​Network/​vpnGateways/​getbgppeerstatus/​action

Returns the status of BGP peers connected to the gateway, revealing the identity and reachability of peer routers in the connected on-prem/remote network. Read-only, but useful reconnaissance for planning lateral movement beyond Azure. getlearnedroutes and getadvertisedroutes are functionally near-identical (same BGP/routing-table disclosure) and are treated the same way.

Risks

1. Network discovery (LOW)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links