lacework-global-587
9.10 Ensure FTP deployments are Disabled (Automated)
Profile Applicability
• Level 1
Description
By default, Azure Functions, Web, and API Services can be deployed over FTP. If FTP is required for an essential deployment workflow, FTPS should be required for FTP login for all App Service Apps and Functions.
Rationale
Azure FTP deployment endpoints are public. An attacker listening to traffic on a wifi network used by a remote employee or a corporate network could see login traffic in clear-text which would then grant them full control of the code base of the app or service. This finding is more severe if User Credentials for deployment are set at the subscription level rather than using the default Application Credentials which are unique per App.
Impact
Any deployment workflows that rely on FTP or FTPs rather than the WebDeploy or HTTPs endpoints may be affected.
Audit
From Azure Portal
- Go to the Azure Portal
- Select
App Services
- Click on an app
- Select
Settings
and thenConfiguration
- Under
General Settings
, for thePlatform Settings
, theFTP state
should not be set toAll allowed
From Azure CLI
List webapps to obtain the ids.
az webapp list
List the publish profiles to obtain the username, password and ftp server url.
az webapp deployment list-publishing-profiles --ids <ids>
{
"publishUrl": <URL_FOR_WEB_APP>,
"userName": <USER_NAME>,
"userPWD": <USER_PASSWORD>,
}
From Azure PowerShell
List all Web Apps:
Get-AzWebApp
For each app:
Get-AzWebApp -ResourceGroupName <resource group name> -Name <app name> | Select-Object -ExpandProperty SiteConfig
In the output, look for the value of FtpsState. If its value is AllAllowed the setting is out of compliance. Any other value is considered in compliance with this check.
Remediation
From Azure Portal
- Go to the Azure Portal
- Select
App Services
- Click on an app
- Select
Settings
and thenConfiguration
- Under
General Settings
, for thePlatform Settings
, theFTP state
should be set toDisabled
orFTPS Only
From Azure CLI
For each out of compliance application, run the following choosing either 'disabled' or 'FtpsOnly' as appropriate:
az webapp config set --resource-group <resource group name> --name <app name> --ftps-state [disabled|FtpsOnly]
From Azure PowerShell
For each out of compliance application, run the following:
Set-AzWebApp -ResourceGroupName <resource group name> -Name <app name> -FtpsState <Disabled or FtpsOnly>
References
https://docs.microsoft.com/en-us/azure/app-service/deploy-ftp)
https://docs.microsoft.com/en-us/azure/app-service/overview-security)
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-data-protection#dp-4-encrypt-sensitive-information-in-transit
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-posture-vulnerability-management#pv-7-rapidly-and-automatically-remediate-software-vulnerabilities