Azure App Service Client Certificate Disabled

• Query id: a81573f9-3691-4d83-88a0-7d4af63e17a3
• Query name: Azure App Service Client Certificate Disabled
• Platform: Terraform
• Severity: Medium
• Category: Insecure Configurations
• CWE: 295
• Risk score: 6.2
• URL: Github

Description

Azure App Service client certificate should be enabled
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - tf file

resource "azurerm_app_service" "positive1-1" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id
}

resource "azurerm_app_service" "positive1-2" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  client_cert_enabled = false
}

resource "azurerm_app_service" "positive1-3" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    http2_enabled            = false
  }

  client_cert_enabled = false
}

resource "azurerm_app_service" "positive1-4" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    http2_enabled            = false
  }
}

resource "azurerm_app_service" "positive1-5" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {}
}

resource "azurerm_app_service" "positive1-6" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {}

  client_cert_enabled = false
}

Positive test num. 2 - tf file

resource "azurerm_linux_web_app" "positive2-1" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id = azurerm_linux_web_app_plan.example.id
  site_config {}
}

resource "azurerm_linux_web_app" "positive2-2" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id = azurerm_linux_web_app_plan.example.id

  site_config{}

  client_certificate_enabled = false
}

resource "azurerm_linux_web_app" "positive2-3" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id = azurerm_linux_web_app_plan.example.id

  site_config {
    http2_enabled            = false
  }

  client_certificate_enabled = false
}

resource "azurerm_linux_web_app" "positive2-4" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id = azurerm_linux_web_app_plan.example.id

  site_config {
    http2_enabled            = false
  }
}

Positive test num. 3 - tf file

resource "azurerm_windows_web_app" "positive3-1" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id = azurerm_windows_web_app_plan.example.id
  site_config{}
}

resource "azurerm_windows_web_app" "positive3-2" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id = azurerm_windows_web_app_plan.example.id

  site_config{}

  client_certificate_enabled = false
}

resource "azurerm_windows_web_app" "positive3-3" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id = azurerm_windows_web_app_plan.example.id

  site_config {
    http2_enabled            = false
  }

  client_certificate_enabled = false
}

resource "azurerm_windows_web_app" "positive3-4" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id = azurerm_windows_web_app_plan.example.id

  site_config {
    http2_enabled            = false
  }
}

Code samples without security vulnerabilities

Negative test num. 1 - tf file

resource "azurerm_app_service" "negative1-1" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  client_cert_enabled = true
}

resource "azurerm_app_service" "negative1-2" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {}

  client_cert_enabled = true
}

resource "azurerm_app_service" "negative1-3" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    http2_enabled            = true
  }
}

resource "azurerm_app_service" "negative1-4" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    http2_enabled            = true
  }

  client_cert_enabled = false
}

resource "azurerm_app_service" "negative1-5" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    http2_enabled            = false
  }

  client_cert_enabled = true
}

resource "azurerm_app_service" "negative1-6" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {}

  client_cert_enabled = true
}

Negative test num. 2 - tf file

resource "azurerm_linux_web_app" "negative2-1" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id     = azurerm_linux_web_app_plan.example.id

  site_config {}

  client_certificate_enabled = true
}

resource "azurerm_linux_web_app" "negative2-2" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    http2_enabled            = true
  }
}

resource "azurerm_linux_web_app" "negative2-3" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id     = azurerm_linux_web_app_plan.example.id

  site_config {
    http2_enabled            = true
  }

  client_certificate_enabled = false
}

resource "azurerm_linux_web_app" "negative2-4" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id     = azurerm_linux_web_app_plan.example.id

  site_config {
    http2_enabled            = false
  }

  client_certificate_enabled = true
}

Negative test num. 3 - tf file

resource "azurerm_windows_web_app" "negative3-1" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id     = azurerm_windows_web_app_plan.example.id

  site_config {}

  client_certificate_enabled = true
}

resource "azurerm_windows_web_app" "negative3-2" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    http2_enabled            = true
  }
}

resource "azurerm_windows_web_app" "negative3-3" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id     = azurerm_windows_web_app_plan.example.id

  site_config {
    http2_enabled            = true
  }

  client_certificate_enabled = false
}

resource "azurerm_windows_web_app" "negative3-4" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id     = azurerm_windows_web_app_plan.example.id

  site_config {
    http2_enabled            = false
  }

  client_certificate_enabled = true
}