nuclei-templates/cloud/azure/network/azure-nsg-netbios-unrestric...

57 lines
2.1 KiB
YAML

id: azure-nsg-netbios-unrestricted
info:
name: Unrestricted NetBIOS Access in Azure NSGs
author: princechaddha
severity: high
description: |
Ensure that Microsoft Azure network security groups (NSGs) do not allow unrestricted inbound access on TCP port 139 and UDP ports 137 and 138, used by NetBIOS, to protect against unauthorized network exploration and exploitation.
impact: |
Unrestricted NetBIOS access can expose network systems to information enumeration, system exploitation, and potential unauthorized access.
remediation: |
Update NSG rules to limit NetBIOS access to only necessary and secure sources, thereby enhancing the overall security posture of your network infrastructure.
reference:
- https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
tags: cloud,devops,azure,microsoft,nsg,azure-cloud-config
flow: |
code(1);
for (let NsgData of iterate(template.nsgdata)) {
NsgData = JSON.parse(NsgData)
set("nsg", NsgData.name)
set("resourcegroup", NsgData.resourceGroup)
code(2)
}
self-contained: true
code:
- engine:
- sh
- bash
source: |
az network nsg list --query '[*].{name:name, resourceGroup:resourceGroup}' --output json
extractors:
- type: json
name: nsgdata
internal: true
json:
- '.[]'
- engine:
- sh
- bash
source: |
az network nsg rule list --nsg-name $nsg --resource-group $resourcegroup --query "[?direction=='Inbound' && access=='Allow' && (protocol=='TCP' && destinationPortRange=='139' || protocol=='UDP' && (destinationPortRange=='137' || destinationPortRange=='138'))]"
matchers:
- type: word
words:
- '"sourceAddressPrefix": "*"'
- '"sourceAddressPrefix": "internet"'
- '"sourceAddressPrefix": "any"'
extractors:
- type: dsl
dsl:
- 'nsg + " has unrestricted access on NetBIOS ports"'
# digest: 4b0a00483046022100d4d58afb1c9d4acfcc3540c232018a75087b22d0b9cece3ed65c6989c9343050022100c4d1cf0dabfbb5034606481aa92d963c80c7d51e711c4ef5d081f04af24234df:922c64590222798bb761d5b6d8e72950