azure-vwan-hub-routetable-write
Write access to hub route tables (hubRouteTables/write) lets an attacker inject custom routes redirecting spoke traffic through an attacker-controlled next hop (NVA/VM), enabling network interception or MitM within the vWAN transit topology.
match (effective permission)
{
"action": "Microsoft.Network/virtualHubs/hubRouteTables/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | TransitGateway |
| source | <principal> |
| target | <Virtual Hub (TransitGateway node)> |
| permissions | Microsoft.Network/virtualHubs/hubRouteTables/write |
| state logic | ACTIVE: the principal can create or modify hub route table entries immediately. Route changes propagate to connected spokes automatically via BGP. Emit BLOCKED if a deny assignment covers this action at the hub or RG scope. |
Narrative
{principal.name} can modify hub route tables on {target.name} (hubRouteTables/write), enabling injection of custom routes to redirect spoke traffic through an attacker- controlled next hop for network interception within the vWAN topology.
Raw rule rules/derived/azure/vwan.yaml
id: azure-vwan-hub-routetable-write
emits: CanModifyConfiguration
description: Write access to hub route tables (hubRouteTables/write) lets an attacker inject custom routes
redirecting spoke traffic through an attacker-controlled next hop (NVA/VM), enabling network interception
or MitM within the vWAN transit topology.
match_effective_permission:
action: Microsoft.Network/virtualHubs/hubRouteTables/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: TransitGateway
source: <principal>
target: <Virtual Hub (TransitGateway node)>
permissions:
- Microsoft.Network/virtualHubs/hubRouteTables/write
state_logic: 'ACTIVE: the principal can create or modify hub route table entries immediately. Route
changes propagate to connected spokes automatically via BGP. Emit BLOCKED if a deny assignment covers
this action at the hub or RG scope.'
false_positive_note: "The default route table (defaultRouteTable) governs all traffic not matched by\
\ custom tables; write access to it redirects traffic for all connected spokes. Custom route tables\
\ only affect spokes explicitly associated with that table. Actual traffic interception requires a\
\ valid, reachable next-hop NVA/VM at the injected address \u2014 if the attacker does not control\
\ a resource at the next-hop IP, traffic is blackholed not intercepted. Record which route table (default\
\ vs. custom) the effective permission applies to as a property on the emitted edge."
narrative: '{principal.name} can modify hub route tables on {target.name} (hubRouteTables/write), enabling
injection of custom routes to redirect spoke traffic through an attacker- controlled next hop for
network interception within the vWAN topology.'
derived_from:
- '<effective permission record: virtualHubs/hubRouteTables/write>'