azure-lb-backend-pool-write

id: azure-lb-backend-pool-write
emits: CanModifyConfiguration
description: Writing a Load Balancer backend address pool allows adding an attacker-controlled VM to the
  pool, routing a fraction of traffic to it for interception or amplification.
match_effective_permission:
  action: Microsoft.Network/loadBalancers/backendAddressPools/write
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: LoadBalancer
  source: <principal>
  target: <Microsoft.Network/loadBalancers in scope>
  permissions:
  - Microsoft.Network/loadBalancers/backendAddressPools/write
  escalation: Add an attacker-controlled VM or IP to the backend pool. The LB will distribute incoming
    traffic across all pool members; the attacker receives a fraction of sessions. This enables partial
    traffic interception (MitM) for credential capture, session hijacking, or lateral movement. Full traffic
    hijacking requires also removing legitimate backends (needs loadBalancers/write) or removing the pool
    and recreating it (backendAddressPools/delete + write).
  false_positive_note: An attacker with backendAddressPools/write can only add to the pool; they do not
    receive ALL traffic by default, only their fraction (1/N of sessions). Impact is traffic interception
    on a subset of connections, not full MitM unless combined with removal of other backends or modification
    of the LB's distribution algorithm (also requires loadBalancers/write). The attack is high-value for
    credential capture (user login sessions) but does not grant execution on the legitimate backends.
    Narrow scopes (backendAddressPools/write on a specific pool) are less dangerous than the full loadBalancers/write
    wildcard but still attack-relevant.
  narrative: '{principal.name} can modify the backend address pool on load balancer {target.name} (backendAddressPools/write),
    allowing them to add an attacker-controlled VM or IP. Incoming traffic will be distributed to the
    attacker''s machine along with legitimate backends, enabling traffic interception and credential capture.'