App Service FTPS Enforce Disabled

  • Query id: 85da374f-b00f-4832-9d44-84a1ca1e89f8
  • Query name: App Service FTPS Enforce Disabled
  • Platform: Terraform
  • Severity: Medium
  • Category: Insecure Configurations
  • CWE: 665
  • Risk score: 5.4
  • URL: Github

Description

Azure App Service should only enforce FTPS when 'ftps_state' is enabled
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - tf file
resource "azurerm_app_service" "positive1" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
    ftps_state               = "AllAllowed" # Options: AllAllowed, FtpsOnly, Disabled
  }
}
Positive test num. 2 - tf file
resource "azurerm_linux_web_app" "positive2" {
  name                = "positive2"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_service_plan.example.location
  service_plan_id     = azurerm_service_plan.example.id

  site_config {
    ftps_state = "AllAllowed" # Options: AllAllowed, FtpsOnly, Disabled
  }
}
Positive test num. 3 - tf file
resource "azurerm_windows_web_app" "positive3" {
  name                = "positive3"
  location            = azurerm_service_plan.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id     = azurerm_service_plan.example.id

  site_config {
    ftps_state = "AllAllowed" # Options: AllAllowed, FtpsOnly, Disabled
  }
}

Code samples without security vulnerabilities

Negative test num. 1 - tf file
resource "azurerm_app_service" "negative1" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
    ftps_state               = "FtpsOnly" # Options: AllAllowed, FtpsOnly, Disabled
  }
}
Negative test num. 2 - tf file
resource "azurerm_app_service" "negative2" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
    ftps_state               = "Disabled"
  }
}
Negative test num. 3 - tf file
resource "azurerm_linux_web_app" "negative3" {
  name                = "negative3"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_service_plan.example.location
  service_plan_id     = azurerm_service_plan.example.id

  site_config {
    ftps_state = "Disabled" # Options: AllAllowed, FtpsOnly, Disabled
  }
}

Negative test num. 4 - tf file 
resource "azurerm_linux_web_app" "negative4" {
  name                = "negative4"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_service_plan.example.location
  service_plan_id     = azurerm_service_plan.example.id

  site_config {
    ftps_state = "FtpsOnly" # Options: AllAllowed, FtpsOnly, Disabled
  }
}
Negative test num. 5 - tf file 
resource "azurerm_windows_web_app" "negative5" {
  name                = "negative5"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_service_plan.example.location
  service_plan_id     = azurerm_service_plan.example.id

  site_config {
    ftps_state = "Disabled" # Options: AllAllowed, FtpsOnly, Disabled
  }
}
Negative test num. 6 - tf file 
resource "azurerm_windows_web_app" "negative6" {
  name                = "negative6"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_service_plan.example.location
  service_plan_id     = azurerm_service_plan.example.id

  site_config {
    ftps_state = "FtpsOnly" # Options: AllAllowed, FtpsOnly, Disabled
  }
}