Azure PostgreSQL Access From Azure Services Disabled

ID: azure-postgres-allow-azure-services-disabled

Severity: high

Author: princechaddha

Tags: cloud,devops,azure,microsoft,postgresql,azure-cloud-config

Description

Ensure that the access from Microsoft Azure cloud services to Azure Database for PostgreSQL servers is disabled in order to secure access to PostgreSQL databases by allowing access from trusted Virtual Networks (Vnets) only.

YAML Source

id: azure-postgres-allow-azure-services-disabled
info:
  name: Azure PostgreSQL Access From Azure Services Disabled
  author: princechaddha
  severity: high
  description: |
    Ensure that the access from Microsoft Azure cloud services to Azure Database for PostgreSQL servers is disabled in order to secure access to PostgreSQL databases by allowing access from trusted Virtual Networks (Vnets) only.
  impact: |
    Not restricting access to Azure Database for PostgreSQL servers from Azure services can expose sensitive database resources to potentially malicious traffic from within Azure, increasing the risk of breaches and data exposure.
  remediation: |
    Configure firewall rules to disable the "Allow access to Azure services" setting for Azure PostgreSQL Database servers to restrict access to trusted sources only.
  reference:
    - https://docs.microsoft.com/en-us/azure/postgresql/concepts-firewall-rules
  tags: cloud,devops,azure,microsoft,postgresql,azure-cloud-config

flow: |
  code(1);
  for (let ServerData of iterate(template.serverList)) {
    ServerData = JSON.parse(ServerData);
    set("name", ServerData.name);
    set("resourceGroup", ServerData.resourceGroup);
    code(2);
  }

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      az postgres server list --output json --query '[*].{"name":name,"resourceGroup":resourceGroup}'

    extractors:
      - type: json
        name: serverList
        internal: true
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
      az postgres server firewall-rule list --server "$name" --resource-group "$resourceGroup" --query '[*].{"ruleName":name,"startIpAddress":startIpAddress,"endIpAddress":endIpAddress}'

    matchers:
      - type: word
        words:
          - '"ruleName": "AllowAllWindowsAzureIps"'
          - 'startIpAddress": "0.0.0.0"'
          - '"endIpAddress": "0.0.0.0"'
        condition: and

    extractors:
      - type: dsl
        dsl:
          - 'name + " in " + resourceGroup + " allows access to Azure services"'
# digest: 4b0a00483046022100ebc86908f7f187db5ef901fa397b3c11463c42b009dc3948448a5b1b00a9a7ae022100bf65c7b41d1ca5f05644d08dba6932be098d4b425c98ea65f5f2d0f27db0a4da:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "cloud/azure/postgresql/azure-postgres-allow-azure-services-disabled.yaml"

View on Github