Skip to content

Commit d7afd09

Browse files
GeekMasherGeekMasher
committed
feat(security): Add security checks for Azure Web Apps including Always On, public network access, client certificate requirements, remote debugging, and HTTPS-only settings
1 parent d27b7bf commit d7afd09

10 files changed

+429
-0
lines changed

‎ql/src/reliability/WebAppAlwaysOnDisabled.md

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# Web App without Always On enabled
2+
3+
Azure Web Apps should have the "Always On" setting enabled in production environments to ensure reliability, performance, and security. When Always On is disabled, the application may experience cold start delays and periodic shutdowns that could impact availability and security.
4+
5+
## Recommendation
6+
7+
Enable the "Always On" setting for all production Azure Web Apps:
8+
9+
```bicep
10+
resource webApp 'Microsoft.Web/sites@2022-03-01' = {
11+
name: 'myWebApp'
12+
location: location
13+
properties: {
14+
serverFarmId: appServicePlan.id
15+
siteConfig: {
16+
alwaysOn: true // Enable Always On for reliability and security
17+
}
18+
}
19+
}
20+
```
21+
22+
## Example
23+
24+
### Suboptimal configuration
25+
26+
```bicep
27+
resource webAppWithoutAlwaysOn 'Microsoft.Web/sites@2022-03-01' = {
28+
name: 'myWebApp'
29+
location: location
30+
properties: {
31+
serverFarmId: appServicePlan.id
32+
siteConfig: {
33+
// Always On is not explicitly enabled, which can lead to
34+
// application shutdowns and cold starts
35+
}
36+
}
37+
}
38+
```
39+
40+
### Recommended configuration
41+
42+
```bicep
43+
resource webAppWithAlwaysOn 'Microsoft.Web/sites@2022-03-01' = {
44+
name: 'myWebApp'
45+
location: location
46+
properties: {
47+
serverFarmId: appServicePlan.id
48+
siteConfig: {
49+
alwaysOn: true // Explicitly enable Always On
50+
}
51+
}
52+
}
53+
```
54+
55+
## Why this is important
56+
57+
When "Always On" is disabled:
58+
- The application can be unloaded after a period of inactivity
59+
- Cold starts can cause delays for users and create availability issues
60+
- Periodic recycling can interrupt background processes
61+
- Attackers could potentially exploit behavior differences between cold and warm instances
62+
63+
## References
64+
* [Configure an App Service app](https://learn.microsoft.com/en-us/azure/app-service/configure-common)
65+
* [Azure App Service plan overview](https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans)

‎ql/src/reliability/WebAppAlwaysOnDisabled.ql

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/**
2+
* @name Web App without Always On enabled
3+
* @description Azure Web Apps should have Always On enabled to ensure reliability and security.
4+
* @kind problem
5+
* @problem.severity warning
6+
* @security-severity 4.0
7+
* @precision high
8+
* @id bicep/webapp-always-on-disabled
9+
* @tags security
10+
* bicep
11+
* azure
12+
* reliability
13+
*/
14+
15+
import bicep
16+
import codeql.bicep.frameworks.Microsoft.Web
17+
18+
from Web::SitesResource site, Web::SitesProperties::SiteConfig config
19+
where
20+
config = site.getProperties().getSiteConfig() and
21+
not config.isAlwaysOn() and
22+
// Only apply to production web apps, not function apps
23+
site.isWebApp() and
24+
not site.isFunctionApp()
25+
select site, "Azure Web App doesn't have Always On enabled, which can lead to poor reliability and potential security issues due to cold starts."

‎ql/src/security/CWE-284/WebAppPublicNetworkAccess.md

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# Web App with unrestricted public access
2+
3+
Azure Web Apps with unrestricted public network access are potentially vulnerable to attacks from the internet. For sensitive applications, restricting network access by using Virtual Network integration or by disabling public network access provides an additional layer of security.
4+
5+
## Recommendation
6+
7+
Restrict public network access to your Azure Web App by either:
8+
9+
1. Integrating with Azure Virtual Network:
10+
```bicep
11+
resource webApp 'Microsoft.Web/sites@2022-03-01' = {
12+
name: 'myWebApp'
13+
location: location
14+
properties: {
15+
serverFarmId: appServicePlan.id
16+
virtualNetworkSubnetId: subnet.id // Add VNet integration
17+
}
18+
}
19+
```
20+
21+
2. Or by explicitly disabling public network access (for critical applications):
22+
```bicep
23+
resource webApp 'Microsoft.Web/sites@2022-03-01' = {
24+
name: 'myWebApp'
25+
location: location
26+
properties: {
27+
serverFarmId: appServicePlan.id
28+
publicNetworkAccess: 'Disabled' // Disable public network access
29+
}
30+
}
31+
```
32+
33+
## Example
34+
35+
### Insecure configuration
36+
37+
```bicep
38+
resource insecureWebApp 'Microsoft.Web/sites@2022-03-01' = {
39+
name: 'insecureApp'
40+
location: location
41+
properties: {
42+
serverFarmId: appServicePlan.id
43+
// No network restrictions - accessible from anywhere
44+
}
45+
}
46+
```
47+
48+
### Secure configuration
49+
50+
```bicep
51+
resource secureWebApp 'Microsoft.Web/sites@2022-03-01' = {
52+
name: 'secureApp'
53+
location: location
54+
properties: {
55+
serverFarmId: appServicePlan.id
56+
publicNetworkAccess: 'Disabled'
57+
virtualNetworkSubnetId: resourceId('Microsoft.Network/virtualNetworks/subnets', 'myVNet', 'mySubnet')
58+
}
59+
}
60+
```
61+
62+
## References
63+
* [Azure App Service networking features](https://learn.microsoft.com/en-us/azure/app-service/networking-features)
64+
* [Configure regional VNet integration](https://learn.microsoft.com/en-us/azure/app-service/configure-vnet-integration-enable)
65+
* [CWE-284: Improper Access Control](https://cwe.mitre.org/data/definitions/284.html)

‎ql/src/security/CWE-284/WebAppPublicNetworkAccess.ql

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/**
2+
* @name Web App with unrestricted public access
3+
* @description Azure Web Apps should restrict public network access to enhance security.
4+
* @kind problem
5+
* @problem.severity warning
6+
* @security-severity 6.5
7+
* @precision high
8+
* @id bicep/sites-public-network-access
9+
* @tags security
10+
* bicep
11+
* azure
12+
* CWE-284
13+
*/
14+
15+
import bicep
16+
import codeql.bicep.frameworks.Microsoft.Web
17+
18+
from Web::SitesResource site, Web::SitesProperties::Properties props
19+
where
20+
props = site.getProperties() and
21+
// Check if the site has public network access enabled (default) and no VNet integration
22+
props.isPublicNetworkAccessEnabled() and
23+
not exists(StringLiteral vnetSubnetId |
24+
vnetSubnetId = site.getVirtualNetworkSubnetId() or
25+
vnetSubnetId = props.getVirtualNetworkSubnetId()
26+
)
27+
select site, "Azure Web App has unrestricted public network access without VNet integration, potentially increasing attack surface."

‎ql/src/security/CWE-295/WebAppMissingClientCert.md

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# Web App without Client Certificate requirement
2+
3+
Azure Web Apps that handle sensitive operations should consider requiring client certificates for mutual TLS authentication. Client certificates provide an additional layer of security by ensuring that only authenticated clients with valid certificates can access the application.
4+
5+
## Recommendation
6+
7+
For applications handling sensitive information or operations, enable and require client certificates:
8+
9+
```bicep
10+
resource webApp 'Microsoft.Web/sites@2022-03-01' = {
11+
name: 'mySecureWebApp'
12+
location: location
13+
properties: {
14+
serverFarmId: appServicePlan.id
15+
clientCertEnabled: true
16+
clientCertMode: 'Required' // Enforce client certificate validation
17+
}
18+
httpsOnly: true
19+
}
20+
```
21+
22+
## Example
23+
24+
### Incomplete configuration
25+
26+
```bicep
27+
resource webAppWithIncompleteConfig 'Microsoft.Web/sites@2022-03-01' = {
28+
name: 'myWebApp'
29+
location: location
30+
properties: {
31+
serverFarmId: appServicePlan.id
32+
// Client certificates are enabled but not required
33+
clientCertEnabled: true
34+
// Missing clientCertMode: 'Required'
35+
}
36+
httpsOnly: true
37+
}
38+
```
39+
40+
### Secure configuration
41+
42+
```bicep
43+
resource secureWebApp 'Microsoft.Web/sites@2022-03-01' = {
44+
name: 'mySecureWebApp'
45+
location: location
46+
properties: {
47+
serverFarmId: appServicePlan.id
48+
clientCertEnabled: true
49+
clientCertMode: 'Required' // Certificates are required
50+
}
51+
httpsOnly: true
52+
}
53+
```
54+
55+
## References
56+
* [Configure TLS mutual authentication for Azure App Service](https://learn.microsoft.com/en-us/azure/app-service/app-service-web-configure-tls-mutual-auth)
57+
* [Microsoft.Web/sites resource type](https://learn.microsoft.com/en-us/azure/templates/microsoft.web/sites)
58+
* [CWE-295: Improper Certificate Validation](https://cwe.mitre.org/data/definitions/295.html)

‎ql/src/security/CWE-295/WebAppMissingClientCert.ql

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
/**
2+
* @name Web App without Client Certificate requirement
3+
* @description Azure Web Apps handling sensitive operations should require client certificates for additional authentication.
4+
* @kind problem
5+
* @problem.severity warning
6+
* @security-severity 5.0
7+
* @precision medium
8+
* @id bicep/webapp-missing-client-cert
9+
* @tags security
10+
* bicep
11+
* azure
12+
* CWE-295
13+
*/
14+
15+
import bicep
16+
import codeql.bicep.frameworks.Microsoft.Web
17+
18+
from Web::SitesResource site
19+
where
20+
// Site has HTTPS enabled (showing security awareness)
21+
site.isHttpsOnly() and
22+
(
23+
// But doesn't have client certificate enabled at the site level
24+
not site.isClientCertEnabled() or
25+
// Or has it enabled but not set to required in properties
26+
(
27+
site.isClientCertEnabled() and
28+
not site.getProperties().isClientCertRequired()
29+
)
30+
)
31+
select site, "Azure Web App with HTTPS enabled doesn't require client certificates for mutual TLS authentication."

‎ql/src/security/CWE-306/WebAppRemoteDebuggingEnabled.md

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Web App with Remote Debugging enabled
2+
3+
Remote debugging should be disabled in production Azure Web Apps. When remote debugging is enabled in a production environment, it can expose sensitive information and potentially allow unauthorized access to your application.
4+
5+
## Recommendation
6+
7+
Disable remote debugging in production environments:
8+
9+
```bicep
10+
resource webApp 'Microsoft.Web/sites@2022-03-01' = {
11+
name: 'myWebApp'
12+
location: location
13+
properties: {
14+
siteConfig: {
15+
// Ensure remote debugging is disabled
16+
remoteDebuggingEnabled: false
17+
// or omit the property entirely as it defaults to false
18+
}
19+
}
20+
}
21+
```
22+
23+
## Example
24+
25+
### Insecure configuration
26+
27+
```bicep
28+
resource insecureWebApp 'Microsoft.Web/sites@2022-03-01' = {
29+
name: 'insecureApp'
30+
location: location
31+
properties: {
32+
siteConfig: {
33+
// Remote debugging should never be enabled in production
34+
remoteDebuggingEnabled: true
35+
remoteDebuggingVersion: 'VS2019'
36+
}
37+
}
38+
}
39+
```
40+
41+
### Secure configuration
42+
43+
```bicep
44+
resource secureWebApp 'Microsoft.Web/sites@2022-03-01' = {
45+
name: 'secureApp'
46+
location: location
47+
properties: {
48+
siteConfig: {
49+
// Remote debugging is explicitly disabled
50+
remoteDebuggingEnabled: false
51+
}
52+
}
53+
}
54+
```
55+
56+
## References
57+
* [Azure App Service security best practices](https://learn.microsoft.com/en-us/azure/app-service/security-recommendations)
58+
* [Microsoft.Web/sites resource type](https://learn.microsoft.com/en-us/azure/templates/microsoft.web/sites)
59+
* [CWE-306: Missing Authentication for Critical Function](https://cwe.mitre.org/data/definitions/306.html)

‎ql/src/security/CWE-306/WebAppRemoteDebuggingEnabled.ql

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/**
2+
* @name Web App with Remote Debugging enabled
3+
* @description Remote debugging should be disabled in production web apps to prevent unauthorized access.
4+
* @kind problem
5+
* @problem.severity error
6+
* @security-severity 8.0
7+
* @precision high
8+
* @id bicep/webapp-remote-debugging-enabled
9+
* @tags security
10+
* bicep
11+
* azure
12+
* CWE-306
13+
*/
14+
15+
import bicep
16+
import codeql.bicep.frameworks.Microsoft.Web
17+
18+
from Web::SitesResource site, Web::SitesProperties::SiteConfig config
19+
where
20+
config = site.getProperties().getSiteConfig() and
21+
config.isRemoteDebuggingEnabled()
22+
select site, "Azure Web App has remote debugging enabled, which can expose sensitive debugging information."

0 commit comments

Comments
 (0)