services / Azure / Connector Gateway Connection Access Policy

Authorization bindings on a Connector Gateway connection that govern which principals may use the credential-bearing connection to access a backend data source.

Access policies control use of a credential-bearing connection; altering them can grant unauthorized use of the connection and its backend credentials, or revoke legitimate access.

Microsoft.​Web/​connectorGateways/​connections/​accessPolicies/​write

Create/update lets an attacker bind their own principal to the connection, granting authority to wield its stored backend credentials (privilege escalation -> lateral movement to the backend), and via policy replacement can remove legitimate principals' access.

Risks

1. Privilege escalation (CRITICAL)
2. Lateral movement (BOOST)
3. Denial-of-access (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links