services / Azure / Recovery Services vault credential certificate

The vault resource/credential certificate is the authentication trust material used by backup agents and registered clients to authenticate to the Recovery Services vault backend.

Controls the credential trust used to authenticate to vault backup/replication backend operations.

Microsoft.​RecoveryServices/​Vaults/​certificates/​write

Updating the credential certificate installs attacker-controlled authentication material, letting an attacker enroll their own credential for persistent, reusable authenticated access to the vault backend.

Risks

1. Account persistence (BOOST)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links