53 lines
1.9 KiB
YAML
53 lines
1.9 KiB
YAML
id: azure-appservice-client-cert-disabled
|
|
info:
|
|
name: Azure App Service Client Certificate Not Required
|
|
author: princechaddha
|
|
severity: medium
|
|
description: |
|
|
Ensure that your Microsoft Azure App Service web applications are configured to require an SSL certificate from all incoming requests, for security and compliance purposes. Once the certificate is implemented, only web clients that have this valid SSL certificate will be able to reach your web application. By default, incoming client certificates are disabled for Azure App Service web applications.
|
|
impact: |
|
|
If incoming client certificates are not required, unauthorized clients might be able to access the web application, which can lead to security breaches.
|
|
remediation: |
|
|
Configure Azure App Services to require SSL certificates for incoming requests to enhance security and compliance with regulations.
|
|
reference:
|
|
- https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate#require-incoming-certificate
|
|
tags: cloud,devops,azure,microsoft,appservice,azure-cloud-config
|
|
|
|
flow: |
|
|
code(1);
|
|
for (let WebAppId of iterate(template.webAppIds)) {
|
|
set("ids", WebAppId);
|
|
code(2);
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az webapp list --output json --query '[*].id'
|
|
|
|
extractors:
|
|
- type: json
|
|
name: webAppIds
|
|
internal: true
|
|
json:
|
|
- '.[]'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az webapp show --ids "$ids" --query 'clientCertEnabled' --output json
|
|
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- "false"
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- '"Client certificate not required for " + id'
|
|
# digest: 4a0a0047304502210089c327a425b7b4698732549dee4e2dfbf8cbb47534662e96a4c867204cfb704b02202cec66d5f9c2ead85119c3034a84983a2f481821b173f7acdc2b2f3c8b317abe:922c64590222798bb761d5b6d8e72950 |