Azure PostgreSQL Geo-Redundant Backup Not Enabled

ID: azure-postgresql-geo-backup-disabled

Severity: high

Author: princechaddha

Tags: cloud,devops,azure,microsoft,postgresql,azure-cloud-config

Description

Ensure that your Microsoft Azure PostgreSQL database servers have geo-redundant backups enabled, to allow you to restore your PostgreSQL servers to a different Azure region in the event of a regional outage or a disaster.

YAML Source

id: azure-postgresql-geo-backup-disabled
info:
  name: Azure PostgreSQL Geo-Redundant Backup Not Enabled
  author: princechaddha
  severity: high
  description: |
    Ensure that your Microsoft Azure PostgreSQL database servers have geo-redundant backups enabled, to allow you to restore your PostgreSQL servers to a different Azure region in the event of a regional outage or a disaster.
  impact: |
    Not having geo-redundant backups enabled can lead to data loss in the event of regional failures, affecting disaster recovery capabilities.
  remediation: |
    Enable geo-redundant backups in the Azure portal or use Azure CLI to update your PostgreSQL server's backup configuration to enable geo-redundancy.
  reference:
    - https://docs.microsoft.com/en-us/azure/postgresql/concepts-backup
  tags: cloud,devops,azure,microsoft,postgresql,azure-cloud-config

flow: |
  code(1);
  for (let ServerData of iterate(template.serverList)) {
    ServerData = JSON.parse(ServerData);
    set("name", ServerData.name);
    set("resourceGroup", ServerData.resourceGroup);
    code(2);
  }

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      az postgres server list --output json --query '[*].{"name":name, "resourceGroup":resourceGroup}'

    extractors:
      - type: json
        name: serverList
        internal: true
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
      az postgres server show --name "$name" --resource-group "$resourceGroup" --query 'storageProfile.geoRedundantBackup'

    matchers:
      - type: word
        words:
          - '"Disabled"'

    extractors:
      - type: dsl
        dsl:
          - 'name + " in " + resourceGroup + " does not have geo-redundant backups enabled"'
# digest: 490a004630440220150341d6f4e33f0cd8d822d5e0105798567a5bb64cb8c3a08c6167c77731fead0220675f54c54d43e0fac3ebabf0c1381b6eca056b9ca8768880064d192d296b0ba1:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "cloud/azure/postgresql/azure-postgresql-geo-backup-disabled.yaml"

View on Github