services / Azure / Azure VPN gateway

A VpnGateway is an Azure Virtual WAN site-to-site VPN gateway resource that provides cross-premises/hybrid network connectivity, including VPN connections, BGP routing, and IP configuration.

Production network connectivity infrastructure for a single organizational function (hybrid/site-to-site connectivity); compromise can extend reach into peered/on-prem networks or sever connectivity.

Microsoft.​Network/​vpnGateways/​write

Creating or updating the gateway lets an attacker reconfigure VPN connections, routing, or BGP settings, redirecting or exposing hybrid traffic to an attacker-controlled endpoint.

Risks

1. Data manipulation (HIGH)
2. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links