azure-nsg-ftp-unrestricted: Unrestricted FTP Access in Azure NSGs

id: azure-nsg-ftp-unrestricted
info:
  name: Unrestricted FTP Access in Azure NSGs
  author: princechaddha
  severity: high
  description: |
    Ensure that Microsoft Azure network security groups (NSGs) do not allow unrestricted access on TCP ports 20 and 21, used for File Transfer Protocol (FTP), to protect against unauthorized file transfers.
  impact: |
    Unrestricted FTP access can lead to data breaches and unauthorized data manipulation or theft.
  remediation: |
    Update NSG rules to restrict FTP access by allowing only IP addresses that require FTP services on TCP ports 20 and 21.
  reference:
    - https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
  tags: cloud,devops,azure,microsoft,nsg,azure-cloud-config

flow: |
  code(1);
  for (let NsgData of iterate(template.nsgdata)) {
    NsgData = JSON.parse(NsgData)
    set("nsg", NsgData.name)
    set("resourcegroup", NsgData.resourceGroup)
    code(2)
  }

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      az network nsg list --query '[*].{name:name, resourceGroup:resourceGroup}' --output json

    extractors:
      - type: json
        name: nsgdata
        internal: true
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
      az network nsg rule list --nsg-name $nsg --resource-group $resourcegroup --query "[?direction=='Inbound' && access=='Allow' && protocol=='TCP' && (destinationPortRange=='20' || destinationPortRange=='21')]"

    matchers:
      - type: word
        words:
          - '"sourceAddressPrefix": "*"'
          - '"sourceAddressPrefix": "internet"'
          - '"sourceAddressPrefix": "any"'

    extractors:
      - type: dsl
        dsl:
          - 'nsg + " has unrestricted access on TCP ports 20 and 21"'
# digest: 490a0046304402200cdcd2a55425b7588b4e176f64ff98a64e10f2e99350a7427661a91c5cd2e55002204606387e501effff10d101b3ed9d03e686b6fb13c327cdbc0cd1fda336f40ec6:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.