azure-vwan-er-authkey-read
A principal with read access to ExpressRoute circuit authorizations can retrieve the authorization key in plaintext, enabling a gateway in a DIFFERENT subscription to connect to the same circuit, bridging network topologies and bypassing subscription boundaries.
match (effective permission)
{
"action": "Microsoft.Network/expressRouteCircuits/authorizations/read",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Secret |
| source | <principal> |
| target | <ER authorization key modeled as a Secret node> |
| permissions | Microsoft.Network/expressRouteCircuits/authorizations/read |
| state logic | ACTIVE when the principal has effective expressRouteCircuits/authorizations/read permission at the circuit, RG, or subscription scope AND the authorization key material is retrievable from the ARM response. The key alone is fully usable: an attacker controls or can provision an ExpressRoute Gateway in ANY subscription to redeem it and connect to the circuit, bridging the local estate to on-premises networks connected via that circuit. |
Narrative
{principal.name} can read the authorization key for ExpressRoute circuit {circuit.name} (expressRouteCircuits/authorizations/read), enabling a gateway in a different subscription to connect to the circuit and bridge network topologies across subscription boundaries.
Raw rule rules/derived/azure/vwan.yaml
id: azure-vwan-er-authkey-read
emits: CanReadSecret
description: A principal with read access to ExpressRoute circuit authorizations can retrieve the authorization
key in plaintext, enabling a gateway in a DIFFERENT subscription to connect to the same circuit, bridging
network topologies and bypassing subscription boundaries.
match_effective_permission:
action: Microsoft.Network/expressRouteCircuits/authorizations/read
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Secret
source: <principal>
target: <ER authorization key modeled as a Secret node>
permissions:
- Microsoft.Network/expressRouteCircuits/authorizations/read
state_logic: 'ACTIVE when the principal has effective expressRouteCircuits/authorizations/read permission
at the circuit, RG, or subscription scope AND the authorization key material is retrievable from the
ARM response. The key alone is fully usable: an attacker controls or can provision an ExpressRoute
Gateway in ANY subscription to redeem it and connect to the circuit, bridging the local estate to
on-premises networks connected via that circuit.'
false_positive_note: "The ER authorization key is a cross-subscription credential: its value enables\
\ external gateways to connect to the circuit. The key is fully exposed (no secondary gate) once read.\
\ An attacker who retrieves the key gains the ability to connect a gateway in a different subscription\
\ or Azure tenant (if authorized) to the same circuit \u2014 a network-layer pivot across account/subscription\
\ boundaries. Model as ACTIVE because the prerequisite (key material) is fully obtained."
narrative: '{principal.name} can read the authorization key for ExpressRoute circuit {circuit.name}
(expressRouteCircuits/authorizations/read), enabling a gateway in a different subscription to connect
to the circuit and bridge network topologies across subscription boundaries.'
derived_from:
- '<effective permission record: expressRouteCircuits/authorizations/read>'