57 lines
2.1 KiB
YAML
57 lines
2.1 KiB
YAML
id: azure-nsg-netbios-unrestricted
|
|
info:
|
|
name: Unrestricted NetBIOS Access in Azure NSGs
|
|
author: princechaddha
|
|
severity: high
|
|
description: |
|
|
Ensure that Microsoft Azure network security groups (NSGs) do not allow unrestricted inbound access on TCP port 139 and UDP ports 137 and 138, used by NetBIOS, to protect against unauthorized network exploration and exploitation.
|
|
impact: |
|
|
Unrestricted NetBIOS access can expose network systems to information enumeration, system exploitation, and potential unauthorized access.
|
|
remediation: |
|
|
Update NSG rules to limit NetBIOS access to only necessary and secure sources, thereby enhancing the overall security posture of your network infrastructure.
|
|
reference:
|
|
- https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
|
|
tags: cloud,devops,azure,microsoft,nsg,azure-cloud-config
|
|
|
|
flow: |
|
|
code(1);
|
|
for (let NsgData of iterate(template.nsgdata)) {
|
|
NsgData = JSON.parse(NsgData)
|
|
set("nsg", NsgData.name)
|
|
set("resourcegroup", NsgData.resourceGroup)
|
|
code(2)
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az network nsg list --query '[*].{name:name, resourceGroup:resourceGroup}' --output json
|
|
|
|
extractors:
|
|
- type: json
|
|
name: nsgdata
|
|
internal: true
|
|
json:
|
|
- '.[]'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az network nsg rule list --nsg-name $nsg --resource-group $resourcegroup --query "[?direction=='Inbound' && access=='Allow' && (protocol=='TCP' && destinationPortRange=='139' || protocol=='UDP' && (destinationPortRange=='137' || destinationPortRange=='138'))]"
|
|
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- '"sourceAddressPrefix": "*"'
|
|
- '"sourceAddressPrefix": "internet"'
|
|
- '"sourceAddressPrefix": "any"'
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- 'nsg + " has unrestricted access on NetBIOS ports"'
|
|
# digest: 4b0a00483046022100d4d58afb1c9d4acfcc3540c232018a75087b22d0b9cece3ed65c6989c9343050022100c4d1cf0dabfbb5034606481aa92d963c80c7d51e711c4ef5d081f04af24234df:922c64590222798bb761d5b6d8e72950 |