azure-vwan-hub-routingintent-write
Write access to hub routing intent policies (routingIntentPolicies/write) lets an attacker modify inter-hub and internet traffic routing, redirecting traffic flows through attacker-controlled firewalls or NVAs or disabling firewall inspection entirely.
match (effective permission)
{
"action": "Microsoft.Network/virtualHubs/routingIntentPolicies/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | TransitGateway |
| source | <principal> |
| target | <Virtual Hub (TransitGateway node)> |
| permissions | Microsoft.Network/virtualHubs/routingIntentPolicies/write |
| conditions | service_state |
| state logic | ACTIVE when the principal has effective routingIntentPolicies/write permission at the hub or containing scope AND Routing Intent feature is available (Standard vWAN with Microsoft.Network/virtualHubs/routingIntentPolicies provider registered). CONDITIONAL(service_state) if the resource provider is not registered in the subscription. Note: routingIntentPolicies is GA as of 2023-01 but provider registration is required. |
Narrative
{principal.name} can modify routing intent policies on hub {target.name} (routingIntentPolicies/write), enabling redirection of inter-hub and internet traffic through an attacker-controlled firewall or NVA or disabling firewall inspection.
Raw rule rules/derived/azure/vwan.yaml
id: azure-vwan-hub-routingintent-write
emits: CanModifyConfiguration
description: Write access to hub routing intent policies (routingIntentPolicies/write) lets an attacker
modify inter-hub and internet traffic routing, redirecting traffic flows through attacker-controlled
firewalls or NVAs or disabling firewall inspection entirely.
match_effective_permission:
action: Microsoft.Network/virtualHubs/routingIntentPolicies/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: TransitGateway
source: <principal>
target: <Virtual Hub (TransitGateway node)>
permissions:
- Microsoft.Network/virtualHubs/routingIntentPolicies/write
conditions:
- service_state
state_logic: 'ACTIVE when the principal has effective routingIntentPolicies/write permission at the
hub or containing scope AND Routing Intent feature is available (Standard vWAN with Microsoft.Network/virtualHubs/routingIntentPolicies
provider registered). CONDITIONAL(service_state) if the resource provider is not registered in the
subscription. Note: routingIntentPolicies is GA as of 2023-01 but provider registration is required.'
false_positive_note: routingIntentPolicies (collection endpoint marked 'preview' in API docs) controls
whether inter-hub and internet traffic flows through a Secure Hub (Azure Firewall or NVA). Write access
enables disabling the firewall, enabling it on a malicious NVA, or redirecting traffic through an
attacker-controlled device. Only emitted for hubs with Routing Intent support (Standard vWAN). Do
not emit for Basic vWAN.
narrative: '{principal.name} can modify routing intent policies on hub {target.name} (routingIntentPolicies/write),
enabling redirection of inter-hub and internet traffic through an attacker-controlled firewall or
NVA or disabling firewall inspection.'
derived_from:
- '<effective permission record: virtualHubs/routingIntentPolicies/write>'