57 lines
2.0 KiB
YAML
57 lines
2.0 KiB
YAML
id: azure-nsg-smtp-unrestricted
|
|
info:
|
|
name: Unrestricted SMTP Access in Azure NSGs
|
|
author: princechaddha
|
|
severity: high
|
|
description: |
|
|
Ensure that Microsoft Azure network security groups (NSGs) do not allow unrestricted inbound access on TCP port 25, used for Simple Mail Transfer Protocol (SMTP), to prevent spam and unauthorized email relay.
|
|
impact: |
|
|
Allowing unrestricted access on TCP port 25 can lead to the misuse of email services, potentially resulting in blacklisting and denial of email service.
|
|
remediation: |
|
|
Configure NSG rules to restrict access to SMTP services on TCP port 25. Allow only trusted IP addresses to send emails and implement proper email authentication mechanisms.
|
|
reference:
|
|
- https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
|
|
tags: cloud,devops,azure,microsoft,nsg,azure-cloud-config
|
|
|
|
flow: |
|
|
code(1);
|
|
for (let NsgData of iterate(template.nsgdata)) {
|
|
NsgData = JSON.parse(NsgData)
|
|
set("nsg", NsgData.name)
|
|
set("resourcegroup", NsgData.resourceGroup)
|
|
code(2)
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az network nsg list --query '[*].{name:name, resourceGroup:resourceGroup}' --output json
|
|
|
|
extractors:
|
|
- type: json
|
|
name: nsgdata
|
|
internal: true
|
|
json:
|
|
- '.[]'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az network nsg rule list --nsg-name $nsg --resource-group $resourcegroup --query "[?direction=='Inbound' && access=='Allow' && protocol=='TCP' && (destinationPortRange=='25')]"
|
|
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- '"sourceAddressPrefix": "*"'
|
|
- '"sourceAddressPrefix": "internet"'
|
|
- '"sourceAddressPrefix": "any"'
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- 'nsg + " has unrestricted access on TCP port 25"'
|
|
# digest: 490a00463044022018673c9b2ac44288c86f98e97e460ff542d656af003ff329c53aee3bf7d0e8be0220683731efa356689449cc6c9236388229c9ca60df78b5722950f2e97b79ee9149:922c64590222798bb761d5b6d8e72950 |