services / Azure / VPN link connection shared key

The IPsec pre-shared key (PSK) for a VPN link connection within a site-to-site VPN gateway connection. This secret authenticates the IPsec tunnel between the Azure VPN gateway and the peer (on-prem/remote) endpoint.

The shared key is a tunnel-authenticating credential; exposure or control of it directly impacts connectivity to and the security of the bridged network.

Microsoft.​Network/​vpnGateways/​vpnConnections/​vpnLinkConnections/​sharedKeys/​default/​listSharedKey/​action

This listSharedKey action returns the VPN link connection's IPsec PSK value (crypto exfiltration); the credential is reusable to impersonate the peer and join the tunnel into the connected network. Semantically identical to the /read operation.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links