nuclei-templates/cloud/azure/aiservices/azure-openai-public-access-disabled.yaml

id: azure-openai-public-access-disabled
info:
  name: Azure OpenAI Public Network Access Not Disabled
  author: princechaddha
  severity: high
  description: |
    Ensure that public network access (i.e. all network access) to Microsoft Azure OpenAI service instances is disabled in order to enhance security by preventing unauthorized access.
  impact: |
    Enabling public network access to Azure OpenAI service instances can lead to unauthorized access, compromising the security and integrity of the instances.
  remediation: |
    Configure the Azure OpenAI service instances to disable public network access to secure them against unauthorized external access.
  reference:
    - https://docs.microsoft.com/en-us/azure/cognitive-services/cognitive-services-apis-create-account-cli?tabs=windows
  tags: cloud,devops,azure,microsoft,openai,azure-cloud-config

flow: |
  code(1);
  for (let ServiceData of iterate(template.serviceList)) {
    ServiceData = JSON.parse(ServiceData);
    set("name", ServiceData.name);
    set("resourceGroup", ServiceData.resourceGroup);
    code(2);
  }

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      az cognitiveservices account list --output json --query '[?(kind==`OpenAI`)].{"name":name,"resourceGroup":resourceGroup}'

    extractors:
      - type: json
        name: serviceList
        internal: true
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
      az cognitiveservices account show --name "$name" --resource-group "$resourceGroup" --query '{networkAcls:properties.networkAcls.defaultAction,publicNetworkAccess:properties.publicNetworkAccess}'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"networkAcls": "Allow"'
          - '"networkAcls": "null"'

      - type: word
        words:
          - '"publicNetworkAccess": "Enabled"'

    extractors:
      - type: dsl
        dsl:
          - '"$name in $resourceGroup has public network access enabled"'
# digest: 4b0a00483046022100de8c064cd10618c1935bb70fdd10b8426c6a5b0194f6acde2c467586481d3092022100fec0b641e8445405d586c67ebc42a56d0c1bfe872de0c72c815e36d052b25d4b:922c64590222798bb761d5b6d8e72950