services / Azure / Site Recovery protected item unplanned failover

Triggers an unplanned failover of a protected item to its recovery region, bringing the workload up from a recovery point without a graceful shutdown of the source.

An unplanned failover forcibly relocates the live workload to the recovery site, which is disruptive to production and can move the workload into an attacker-chosen network or region.

Microsoft.​RecoveryServices/​Vaults/​replicationFabrics/​replicationProtectionContainers/​replicationProtectedItems/​unplannedFailover/​action

Forces the workload over to the recovery region, disrupting the running service and relocating it into the configured recovery network the attacker may control.

Risks

1. Denial-of-service (HIGH)
2. Network movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links