azure-vnet-route-write
Write access to route table routes lets an attacker add a UDR redirecting traffic through an attacker-controlled next hop (NVA) - enabling traffic interception.
match (effective permission)
{
"action": "Microsoft.Network/routeTables/routes/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
route table is already associated with at least one subnet (existing association takes effect immediately)
emit
| source type | Identity |
|---|---|
| target type | Network |
| source | <principal> |
| target | <route table> |
| permissions | Microsoft.Network/routeTables/routes/write |
| state logic | ACTIVE when the route table is already associated with a subnet (modifying existing routes takes effect immediately on next route refresh). CONDITIONAL(iam_permission) when a NEW route table is not yet associated with a subnet (requires additional Microsoft.Network/virtualNetworks/subnets/write to associate and take effect). |
Narrative
{principal.name} can add or modify route entries in route table {target.name} (routeTables/routes/write), enabling traffic redirection through an attacker-controlled next hop for MitM or lateral-movement purposes.
Raw rule rules/derived/azure/vnet.yaml
id: azure-vnet-route-write
emits: CanModifyConfiguration
description: "Write access to route table routes lets an attacker add a UDR redirecting traffic through\
\ an attacker-controlled next hop (NVA) \u2014 enabling traffic interception."
match_effective_permission:
action: Microsoft.Network/routeTables/routes/write
scope_type: resource|resourceGroup|subscription
where:
- route table is already associated with at least one subnet (existing association takes effect immediately)
emit:
source_type: Identity
target_type: Network
source: <principal>
target: <route table>
permissions:
- Microsoft.Network/routeTables/routes/write
state_logic: ACTIVE when the route table is already associated with a subnet (modifying existing routes
takes effect immediately on next route refresh). CONDITIONAL(iam_permission) when a NEW route table
is not yet associated with a subnet (requires additional Microsoft.Network/virtualNetworks/subnets/write
to associate and take effect).
false_positive_note: routeTables/routes/write alone enables route manipulation on existing tables. Associating
a NEW route table with a subnet additionally requires Microsoft.Network/virtualNetworks/subnets/write.
Modifying an existing route table associated with a subnet takes effect immediately on the next route
refresh (BGP propagation or system refresh). Honor deny assignments.
narrative: '{principal.name} can add or modify route entries in route table {target.name} (routeTables/routes/write),
enabling traffic redirection through an attacker-controlled next hop for MitM or lateral-movement
purposes.'
derived_from:
- '<effective permission record: routeTables/routes/write>'