Function App FTPS Enforce Disabled

• Query id: 9dab0179-433d-4dff-af8f-0091025691df
• Query name: Function App FTPS Enforce Disabled
• Platform: Terraform
• Severity: Medium
• Category: Insecure Configurations
• CWE: 665
• Risk score: 5.4
• URL: Github

Description

Azure Function App should only enforce FTPS when 'ftps_state' is enabled
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - tf file

resource "azurerm_function_app" "positive1-1" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  app_service_plan_id        = azurerm_app_service_plan.example.id

   site_config {
    http2_enabled = true
    ftps_state = "AllAllowed"
  }
}

resource "azurerm_function_app" "positive1-2" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  app_service_plan_id        = azurerm_app_service_plan.example.id

   site_config {
    http2_enabled = true
  }
}

resource "azurerm_function_app" "positive1-3" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  app_service_plan_id        = azurerm_app_service_plan.example.id
}

Positive test num. 2 - tf file

resource "azurerm_linux_function_app" "positive2" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id

   site_config {
    http2_enabled = true
    ftps_state = "AllAllowed"
  }
}

Positive test num. 3 - tf file

resource "azurerm_windows_function_app" "positive3" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id

   site_config {
    http2_enabled = true
    ftps_state = "AllAllowed"
  }
}

Code samples without security vulnerabilities

Negative test num. 1 - tf file

resource "azurerm_function_app" "negative1-1" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  app_service_plan_id        = azurerm_app_service_plan.example.id

   site_config {
    ftps_state = "FtpsOnly"
  }
}

resource "azurerm_function_app" "negative1-2" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  app_service_plan_id        = azurerm_app_service_plan.example.id

   site_config {
    ftps_state = "Disabled"
  }
}

Negative test num. 2 - tf file

resource "azurerm_linux_function_app" "negative2-1" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id

   site_config {
    ftps_state = "FtpsOnly"
  }
}

resource "azurerm_linux_function_app" "negative2-2" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id

   site_config {
    ftps_state = "Disabled"
  }
}

resource "azurerm_linux_function_app" "negative2-3" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id

   site_config {
    http2_enabled = true
  }
}

resource "azurerm_linux_function_app" "negative2-4" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id
}

Negative test num. 3 - tf file

resource "azurerm_windows_function_app" "negative3-1" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id

   site_config {
    ftps_state = "FtpsOnly"
  }
}

resource "azurerm_windows_function_app" "negative3-2" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id

   site_config {
    ftps_state = "Disabled"
  }
}

resource "azurerm_windows_function_app" "negative3-3" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id

   site_config {
    http2_enabled = true
  }
}

resource "azurerm_windows_function_app" "negative3-4" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id
}