57 lines
2.1 KiB
YAML
57 lines
2.1 KiB
YAML
id: azure-nsg-mssql-unrestricted
|
|
info:
|
|
name: Unrestricted MS SQL Server Access in Azure NSGs
|
|
author: princechaddha
|
|
severity: high
|
|
description: |
|
|
Ensure that Microsoft Azure network security groups (NSGs) do not allow unrestricted inbound access on TCP port 1433, used by Microsoft SQL Server, to protect against unauthorized database access and potential data breaches.
|
|
impact: |
|
|
Unrestricted access on TCP port 1433 can expose SQL Servers to attacks such as SQL injection and brute-force attacks, leading to potential data loss and system compromise.
|
|
remediation: |
|
|
Restrict access to MS SQL Server by configuring NSG rules to only allow trusted sources to connect on TCP port 1433. Implement robust monitoring and alerting mechanisms to detect unauthorized access attempts.
|
|
reference:
|
|
- https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
|
|
tags: cloud,devops,azure,microsoft,nsg,azure-cloud-config
|
|
|
|
flow: |
|
|
code(1);
|
|
for (let NsgData of iterate(template.nsgdata)) {
|
|
NsgData = JSON.parse(NsgData)
|
|
set("nsg", NsgData.name)
|
|
set("resourcegroup", NsgData.resourceGroup)
|
|
code(2)
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az network nsg list --query '[*].{name:name, resourceGroup:resourceGroup}' --output json
|
|
|
|
extractors:
|
|
- type: json
|
|
name: nsgdata
|
|
internal: true
|
|
json:
|
|
- '.[]'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az network nsg rule list --nsg-name $nsg --resource-group $resourcegroup --query "[?direction=='Inbound' && access=='Allow' && protocol=='TCP' && (destinationPortRange=='1433')]"
|
|
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- '"sourceAddressPrefix": "*"'
|
|
- '"sourceAddressPrefix": "internet"'
|
|
- '"sourceAddressPrefix": "any"'
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- 'nsg + " has unrestricted access on TCP port 1433"'
|
|
# digest: 4a0a00473045022100bb232fd95ff33e840a26d5cd6d8a395403c806dfb67ec7226e842ebcf4dcbd070220723161462d7e39677d9be9e6cbd10541be259a5c3515868183bf3d4b2ba5d4bc:922c64590222798bb761d5b6d8e72950 |