azure-vwan-hub-connection-write
Write access to hub VNet connections (hubVirtualNetworkConnections/write) lets an attacker attach a new spoke VNet to the hub, inserting an attacker-controlled VNet into the transit topology and gaining network-layer reach to all existing connected resources, or detach an existing spoke to disrupt connectivity.
match (effective permission)
{
"action": "Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | TransitGateway |
| source | <principal> |
| target | <Virtual Hub (TransitGateway node)> |
| permissions | Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/write |
| conditions | iam_permission |
| state logic | CONDITIONAL(iam_permission): the principal has hubVirtualNetworkConnections/write but ALSO needs Microsoft.Network/virtualNetworks/join/action (or equivalent) on the spoke VNet being connected. If the spoke VNet is in another subscription, they additionally need cross-subscription RBAC. Verify both the hub-side write and the spoke-side join permission before marking ACTIVE. A principal with only hub-write cannot successfully attach a spoke without the spoke-side permission. Emit BLOCKED if a deny assignment covers the write action at the hub, RG, or subscription scope. |
Narrative
{principal.name} can create or modify spoke VNet connections on hub {target.name} (hubVirtualNetworkConnections/write), but requires additional join permission on the spoke VNet to successfully complete the attachment and gain network reach to all connected spokes.
Raw rule rules/derived/azure/vwan.yaml
id: azure-vwan-hub-connection-write
emits: CanModifyConfiguration
description: Write access to hub VNet connections (hubVirtualNetworkConnections/write) lets an attacker
attach a new spoke VNet to the hub, inserting an attacker-controlled VNet into the transit topology
and gaining network-layer reach to all existing connected resources, or detach an existing spoke to
disrupt connectivity.
match_effective_permission:
action: Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: TransitGateway
source: <principal>
target: <Virtual Hub (TransitGateway node)>
permissions:
- Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/write
conditions:
- iam_permission
state_logic: 'CONDITIONAL(iam_permission): the principal has hubVirtualNetworkConnections/write but
ALSO needs Microsoft.Network/virtualNetworks/join/action (or equivalent) on the spoke VNet being connected.
If the spoke VNet is in another subscription, they additionally need cross-subscription RBAC. Verify
both the hub-side write and the spoke-side join permission before marking ACTIVE. A principal with
only hub-write cannot successfully attach a spoke without the spoke-side permission. Emit BLOCKED
if a deny assignment covers the write action at the hub, RG, or subscription scope.'
false_positive_note: 'Adding a hub connection is a two-permission gate: Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/write
(hub-side) AND Microsoft.Network/virtualNetworks/join/action or Contributor on the spoke VNet (spoke-side).
The CanModifyConfiguration edge records the hub-side capability; the spoke-side RBAC gate is a separate
condition. Network Contributor on the hub RG typically includes both permissions. Only emit as ACTIVE
if BOTH permissions are confirmed for the principal in the same scope (or cross-subscription RBAC
is verified).'
narrative: '{principal.name} can create or modify spoke VNet connections on hub {target.name} (hubVirtualNetworkConnections/write),
but requires additional join permission on the spoke VNet to successfully complete the attachment
and gain network reach to all connected spokes.'
derived_from:
- '<effective permission record: virtualHubs/hubVirtualNetworkConnections/write>'