Unrestricted HTTP Access

More Info:

Ensure that no network security groups allow unrestricted inbound access on TCP port 80.

Risk Level

Critical

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• HITRUST CSF
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

The remediation steps for Unrestricted HTTP Access in AZURE are:

1. Login to the AZURE portal (https://portal.azure.com/)
2. Navigate to the Virtual Machine that has unrestricted HTTP access.
3. Click on the “Networking” tab on the left-hand side of the Virtual Machine page.
4. Under the “Inbound port rules” section, click on “Add inbound port rule”.
5. In the “Add inbound security rule” page, provide the following details:
   • Name: A name for the new rule
   • Priority: A number that specifies the priority of the rule. A lower number indicates a higher priority.
   • Protocol: Select “TCP” from the dropdown.
   • Port range: Specify the port range that you want to restrict. For example, if you want to restrict port 80, enter “80” in both the “Start port” and “End port” fields.
   • Action: Select “Deny” from the dropdown.
   • Source: Select “Any” from the dropdown.
   • Destination: Select “Any” from the dropdown.
6. Click on “Add” to create the new rule.
7. Repeat steps 4-6 for all the ports that you want to restrict.
8. Once all the necessary rules have been created, click on “Save” to apply the changes.

After completing these steps, the unrestricted HTTP access should be remediated for the Virtual Machine in AZURE.

Using CLI

To remediate unrestricted HTTP access in AZURE using AZURE CLI, follow the below steps:

1. Login to Azure CLI using the command “az login”. Enter your Azure credentials when prompted.

2. Run the command “az network nsg list” to list all the network security groups (NSGs) in your subscription.

3. Identify the NSG that is associated with the virtual machine or the subnet that has unrestricted HTTP access.

4. Run the command az network nsg rule list --nsg-name <NSG-Name> to list all the rules in the NSG.

5. Identify the rule that allows unrestricted HTTP access.

6. Run the command “az network nsg rule delete —nsg-name <NSG-Name> —name <Rule-Name>” to delete the rule that allows unrestricted HTTP access.

7. Confirm the deletion by running the command az network nsg rule list --nsg-name <NSG-Name> again and verifying that the rule is no longer present.

8. Repeat the above steps for all the NSGs that have unrestricted HTTP access.

9. Once all the rules have been deleted, the unrestricted HTTP access issue should be resolved.

Note: It is recommended to restrict access to HTTP and allow access only through HTTPS to ensure secure communication.

Using Python

To remediate unrestricted HTTP access in Azure using Python, you can use the Azure Python SDK to create a Network Security Group (NSG) and apply it to the virtual network. The NSG will contain a rule that blocks all inbound traffic on port 80.

Here are the step-by-step instructions:

1. Install the Azure Python SDK using pip:

pip install azure-mgmt-network

2. Import the necessary modules:

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.network import NetworkManagementClient
from azure.mgmt.network.models import (
    NetworkSecurityGroup,
    SecurityRule,
    SecurityRuleAccess,
    SecurityRuleDirection,
    SecurityRuleProtocol,
)

3. Create a Service Principal for authentication:

credentials = ServicePrincipalCredentials(
    client_id='<client_id>',
    secret='<client_secret>',
    tenant='<tenant_id>',
)

Replace <client_id>, <client_secret>, and <tenant_id> with your Azure AD credentials.

4. Create an instance of the NetworkManagementClient:

subscription_id = '<subscription_id>'
resource_group_name = '<resource_group_name>'
location = '<location>'

network_client = NetworkManagementClient(
    credentials,
    subscription_id,
)

Replace <subscription_id>, <resource_group_name>, and <location> with your Azure subscription ID, resource group name, and location.

5. Create a Network Security Group:

nsg_name = '<nsg_name>'

nsg_params = NetworkSecurityGroup(
    location=location,
)

nsg_result = network_client.network_security_groups.create_or_update(
    resource_group_name,
    nsg_name,
    nsg_params,
)

Replace <nsg_name> with a name for your Network Security Group.

6. Create a Security Rule to block inbound traffic on port 80:

rule_name = '<rule_name>'

rule_params = SecurityRule(
    protocol=SecurityRuleProtocol.tcp,
    source_port_range='*',
    destination_port_range='80',
    source_address_prefix='*',
    destination_address_prefix='*',
    access=SecurityRuleAccess.deny,
    direction=SecurityRuleDirection.inbound,
    priority=1000,
)

rule_result = network_client.security_rules.create_or_update(
    resource_group_name,
    nsg_name,
    rule_name,
    rule_params,
)

Replace <rule_name> with a name for your Security Rule.

7. Apply the Network Security Group to your virtual network:

vnet_name = '<vnet_name>'

vnet_params = network_client.virtual_networks.get(
    resource_group_name,
    vnet_name,
)

vnet_params.network_security_group = nsg_result

vnet_result = network_client.virtual_networks.create_or_update(
    resource_group_name,
    vnet_name,
    vnet_params,
)

Replace <vnet_name> with the name of your virtual network.

That’s it! The Network Security Group will now block all inbound traffic on port 80, remedying the unrestricted HTTP access misconfiguration.

Using Terraform

# Existing NSG
resource "azurerm_network_security_group" "web_nsg" {
  name                = "WEB_NSG"
  location            = azurerm_resource_group.RG.location
  resource_group_name = azurerm_resource_group.RG.name
}

# Replace any existing "allow from * to port 80" rule with a restricted one.
# Ensure there is NO rule here with source_address_prefix = "*" (or "0.0.0.0/0") on port 80.
resource "azurerm_network_security_rule" "web_http_inbound" {
  name                        = "allow-http-from-trusted"
  priority                    = 100
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_ranges     = ["80"]
  destination_address_prefix  = "*"

  # Replace TRUSTED_CIDR_BLOCK with the specific CIDR(s) that should be allowed,
  # for example "10.0.0.0/16" or your office IP, but NOT "*" or "0.0.0.0/0".
  source_address_prefixes     = ["TRUSTED_CIDR_BLOCK"]

  resource_group_name         = azurerm_resource_group.RG.name
  network_security_group_name = azurerm_network_security_group.web_nsg.name
}

Changing an azurerm_network_security_rule like this does not force replacement of the NSG itself; the rule is updated in place, but traffic behavior changes immediately after apply, which may impact existing HTTP clients not in TRUSTED_CIDR_BLOCK.

For verification, terraform plan should show the existing port 80 rule either being destroyed and replaced, or updated so that source_address_prefix/source_address_prefixes is no longer "*" or "0.0.0.0/0" for inbound TCP on port 80.