services / Azure / VPN gateway connections

A VPN connection on an Azure VPN Gateway represents a site-to-site (or VNet-to-VNet) IPsec/IKE tunnel linking an Azure virtual network to an on-premises or remote network. It carries production hybrid-connectivity traffic for the networks it joins.

Production network connectivity component supporting a single organizational function; controls cross-premises reachability.

Microsoft.​Network/​vpnGateways/​vpnConnections/​stoppacketcapture/​action

Stopping the capture takes a caller-supplied SAS URL and writes the captured PCAP of tunnel traffic to that (attacker-controlled) storage container, completing exfiltration of in-transit network data.

Risks

1. Data exfiltration (CRITICAL)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links