57 lines
2.1 KiB
YAML
57 lines
2.1 KiB
YAML
id: azure-nsg-http-unrestricted
|
|
info:
|
|
name: Unrestricted TCP Port 80 Access in Azure NSGs
|
|
author: princechaddha
|
|
severity: high
|
|
description: |
|
|
Ensure that Microsoft Azure network security groups (NSGs) do not allow unrestricted access on TCP port 80 to protect against attackers using brute force methods to gain access to Azure virtual machines associated with these NSGs.
|
|
impact: |
|
|
Allowing unrestricted access on TCP port 80 can expose virtual machines to potential brute force attacks, increasing the risk of unauthorized access.
|
|
remediation: |
|
|
Modify NSG rules to restrict access on TCP port 80. Ensure that only known IPs are allowed, or implement additional authentication methods to protect against unauthorized access.
|
|
reference:
|
|
- https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
|
|
tags: cloud,devops,azure,microsoft,nsg,azure-cloud-config
|
|
|
|
flow: |
|
|
code(1);
|
|
for (let NsgData of iterate(template.nsgdata)) {
|
|
NsgData = JSON.parse(NsgData)
|
|
set("nsg", NsgData.name)
|
|
set("resourcegroup", NsgData.resourceGroup)
|
|
code(2)
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az network nsg list --query '[*].{name:name, resourceGroup:resourceGroup}' --output json
|
|
|
|
extractors:
|
|
- type: json
|
|
name: nsgdata
|
|
internal: true
|
|
json:
|
|
- '.[]'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az network nsg rule list --nsg-name $nsg --resource-group $resourcegroup --query "[?direction=='Inbound' && access=='Allow' && protocol=='TCP' && (destinationPortRange=='80')]"
|
|
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- '"sourceAddressPrefix": "*"'
|
|
- '"sourceAddressPrefix": "internet"'
|
|
- '"sourceAddressPrefix": "any"'
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- 'nsg + " has unrestricted access on TCP port 80"'
|
|
# digest: 4b0a004830460221008c5583df5db98deb7ebd96efeb4182498e5a605c0c4573126b79d953836fa6b5022100f6879fe80971c04071bffd187b2e55cc129f43b1e479f9219d09da1ef9d9de1e:922c64590222798bb761d5b6d8e72950 |