id: azure-nsg-mysql-unrestricted
info:
  name: Unrestricted MySQL Database Access in Azure NSGs
  author: princechaddha
  severity: high
  description: |
    Ensure that Microsoft Azure network security groups (NSGs) do not allow unrestricted ingress access on TCP port 3306, used by MySQL Database, to prevent unauthorized database access and potential data breaches.
  impact: |
    Allowing unrestricted access on TCP port 3306 can expose MySQL databases to unauthorized access, potentially leading to data loss, data theft, or malicious data manipulation.
  remediation: |
    Modify NSG rules to restrict access on TCP port 3306. Allow connections only from trusted and necessary IP addresses to secure the MySQL databases against unauthorized access.
  reference:
    - https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
  tags: cloud,devops,azure,microsoft,nsg,azure-cloud-config

flow: |
  code(1);
  for (let NsgData of iterate(template.nsgdata)) {
    NsgData = JSON.parse(NsgData)
    set("nsg", NsgData.name)
    set("resourcegroup", NsgData.resourceGroup)
    code(2)
  }

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      az network nsg list --query '[*].{name:name, resourceGroup:resourceGroup}' --output json

    extractors:
      - type: json
        name: nsgdata
        internal: true
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
      az network nsg rule list --nsg-name $nsg --resource-group $resourcegroup --query "[?direction=='Inbound' && access=='Allow' && protocol=='TCP' && (destinationPortRange=='3306')]"

    matchers:
      - type: word
        words:
          - '"sourceAddressPrefix": "*"'
          - '"sourceAddressPrefix": "internet"'
          - '"sourceAddressPrefix": "any"'

    extractors:
      - type: dsl
        dsl:
          - 'nsg + " has unrestricted access on TCP port 3306"'
# digest: 4a0a00473045022072f815905850cc5ea4d8533535b3c5af51a27fa704668aee6878da62924d980e022100ee32dc81252f24929c66f0c2d15b5a3b254aae13485710fd65b6f48a9c3e227f:922c64590222798bb761d5b6d8e72950