azure-vnet-peering-write
Write access to VNet peerings lets an attacker create or modify peerings, extending network reachability from an attacker-controlled VNet into this VNet.
match (effective permission)
{
"action": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal has effective Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write on the local VNet
emit
| source type | Identity |
|---|---|
| target type | VirtualNetwork |
| source | <principal> |
| target | <VNet> |
| permissions | Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write |
| state logic | ACTIVE: the principal can create or modify peerings on this VNet immediately. To complete the peering the remote VNet must also accept (requires Microsoft.Network/virtualNetworks/peer/action or Contributor on the remote side); emit CONDITIONAL(network_reachability) when the remote-side grant is unconfirmed. |
Narrative
{principal.name} can create or modify peerings on VNet {target.name} (virtualNetworkPeerings/write), potentially extending reachability from an attacker-controlled VNet into {target.name}'s address space.
Raw rule rules/derived/azure/vnet.yaml
id: azure-vnet-peering-write
emits: CanModifyConfiguration
description: Write access to VNet peerings lets an attacker create or modify peerings, extending network
reachability from an attacker-controlled VNet into this VNet.
match_effective_permission:
action: Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write
scope_type: resource|resourceGroup|subscription
where:
- principal has effective Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write on the local
VNet
emit:
source_type: Identity
target_type: VirtualNetwork
source: <principal>
target: <VNet>
permissions:
- Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write
state_logic: 'ACTIVE: the principal can create or modify peerings on this VNet immediately. To complete
the peering the remote VNet must also accept (requires Microsoft.Network/virtualNetworks/peer/action
or Contributor on the remote side); emit CONDITIONAL(network_reachability) when the remote-side grant
is unconfirmed.'
false_positive_note: Creating a peering only completes when the REMOTE VNet also has Microsoft.Network/virtualNetworks/peer/action
granted to the initiating principal. An attacker controlling their own VNet in a different subscription
automatically satisfies the remote-side acceptance if they own that VNet. Cross-tenant peering additionally
requires an Entra B2B role grant on the remote side. Do not conflate the write capability (modeled
here as CanModifyConfiguration) with a completed peering (PeeredWith); the latter requires both sides.
narrative: '{principal.name} can create or modify peerings on VNet {target.name} (virtualNetworkPeerings/write),
potentially extending reachability from an attacker-controlled VNet into {target.name}''s address
space.'
derived_from:
- '<effective permission record: virtualNetworkPeerings/write>'