57 lines
2.1 KiB
YAML
57 lines
2.1 KiB
YAML
id: azure-nsg-mysql-unrestricted
|
|
info:
|
|
name: Unrestricted MySQL Database Access in Azure NSGs
|
|
author: princechaddha
|
|
severity: high
|
|
description: |
|
|
Ensure that Microsoft Azure network security groups (NSGs) do not allow unrestricted ingress access on TCP port 3306, used by MySQL Database, to prevent unauthorized database access and potential data breaches.
|
|
impact: |
|
|
Allowing unrestricted access on TCP port 3306 can expose MySQL databases to unauthorized access, potentially leading to data loss, data theft, or malicious data manipulation.
|
|
remediation: |
|
|
Modify NSG rules to restrict access on TCP port 3306. Allow connections only from trusted and necessary IP addresses to secure the MySQL databases against unauthorized access.
|
|
reference:
|
|
- https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
|
|
tags: cloud,devops,azure,microsoft,nsg,azure-cloud-config
|
|
|
|
flow: |
|
|
code(1);
|
|
for (let NsgData of iterate(template.nsgdata)) {
|
|
NsgData = JSON.parse(NsgData)
|
|
set("nsg", NsgData.name)
|
|
set("resourcegroup", NsgData.resourceGroup)
|
|
code(2)
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az network nsg list --query '[*].{name:name, resourceGroup:resourceGroup}' --output json
|
|
|
|
extractors:
|
|
- type: json
|
|
name: nsgdata
|
|
internal: true
|
|
json:
|
|
- '.[]'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az network nsg rule list --nsg-name $nsg --resource-group $resourcegroup --query "[?direction=='Inbound' && access=='Allow' && protocol=='TCP' && (destinationPortRange=='3306')]"
|
|
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- '"sourceAddressPrefix": "*"'
|
|
- '"sourceAddressPrefix": "internet"'
|
|
- '"sourceAddressPrefix": "any"'
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- 'nsg + " has unrestricted access on TCP port 3306"'
|
|
# digest: 4a0a00473045022072f815905850cc5ea4d8533535b3c5af51a27fa704668aee6878da62924d980e022100ee32dc81252f24929c66f0c2d15b5a3b254aae13485710fd65b6f48a9c3e227f:922c64590222798bb761d5b6d8e72950 |