Unrestricted RPC Access

More Info:

Ensure that Microsoft Azure network security groups (NSGs) do not allow unrestricted access (i.e. 0.0.0.0/0) on TCP port 135 in order to implement the principle of least privilege and effectively reduce the attack surface. Remote Procedure Call (RPC) TCP port 135 is used for client-server communications by Microsoft Message Queuing (MSMQ) as well as other Microsoft Windows/Windows Server software.

Risk Level

High

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• FedRAMP
• GDPR
• HIPAA
• HITRUST CSF
• ISO 27001
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST CSF
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the “Unrestricted RPC Access” misconfiguration in Azure using the Azure Console, you can follow these steps:

1. Log in to the Azure portal (https://portal.azure.com/).

2. Navigate to the virtual machine that has the misconfiguration.

3. Click on the “Networking” tab in the left-hand menu.

4. Under “Inbound port rules”, click on “Add inbound port rule”.

5. In the “Add inbound security rule” dialog box, fill in the following information:

• Name: A unique name for the rule (e.g., “RPC Access Restricted”).
• Priority: A number that determines the order in which the rule is applied (e.g., 100).
• Protocol: Select “TCP”.
• Port range: Enter “135-139, 445”.
• Action: Select “Deny”.
• Source: Select “Any”.

6. Click “Add” to create the new rule.

7. Repeat steps 4-6 for any other virtual machines that have the same misconfiguration.

By following these steps, you will have restricted RPC access to the virtual machine, which will help mitigate the risk of unauthorized access.

Using CLI

To remediate unrestricted RPC access in Azure using Azure CLI, follow these steps:

1. Open the Azure CLI command prompt.

2. Run the following command to get a list of all virtual machines in your Azure subscription:

   az vm list --query "[].{Name:name, ResourceGroup:resourceGroup}"

   This will give you a list of all the virtual machines in your subscription along with their resource group names.

3. Identify the virtual machine that has unrestricted RPC access.

4. Run the following command to get the public IP address of the virtual machine:

   az vm show -d -g <resource-group-name> -n <vm-name> --query publicIps -o tsv

   Replace <resource-group-name> with the name of the resource group where the virtual machine is located and <vm-name> with the name of the virtual machine.

5. Note down the public IP address of the virtual machine.

6. Run the following command to create a network security group:

   az network nsg create -g <resource-group-name> -n <nsg-name>

   Replace <resource-group-name> with the name of the resource group where the virtual machine is located and <nsg-name> with a name for the network security group.

7. Run the following command to create a rule in the network security group to block all incoming traffic on port 135:

   az network nsg rule create -g <resource-group-name> --nsg-name <nsg-name> -n block-rpc --priority 100 --source-address-prefixes '*' --destination-port-ranges 135 --access Deny --protocol Tcp --description "Block all incoming traffic on port 135"

   Replace <resource-group-name> with the name of the resource group where the virtual machine is located and <nsg-name> with the name of the network security group that you created in step 6.

8. Run the following command to associate the network security group with the virtual machine’s network interface:

   az network nic update -g <resource-group-name> -n <nic-name> --network-security-group <nsg-name>

   Replace <resource-group-name> with the name of the resource group where the virtual machine is located, <nic-name> with the name of the virtual machine’s network interface, and <nsg-name> with the name of the network security group that you created in step 6.

9. Verify that the network security group is associated with the virtual machine’s network interface by running the following command:

   az network nic show -g <resource-group-name> -n <nic-name> --query networkSecurityGroup

   Replace <resource-group-name> with the name of the resource group where the virtual machine is located and <nic-name> with the name of the virtual machine’s network interface.

10. Verify that the rule to block incoming traffic on port 135 is applied by running the following command:

    az network nsg rule show -g <resource-group-name> --nsg-name <nsg-name> -n block-rpc

    Replace <resource-group-name> with the name of the resource group where the virtual machine is located and <nsg-name> with the name of the network security group that you created in step 6.

By following these steps, you have remediated unrestricted RPC access in Azure using Azure CLI.

Using Python

To remediate the Unrestricted RPC Access misconfiguration in AZURE using Python, you can follow the below steps:

1. Import the required Python libraries:

   from azure.identity import DefaultAzureCredential
   from azure.mgmt.network import NetworkManagementClient
   from azure.mgmt.network.models import SecurityRule, SecurityGroup
   

2. Authenticate with the Azure cloud using the DefaultAzureCredential class:

   credential = DefaultAzureCredential()
   

3. Instantiate a NetworkManagementClient object using the credential object:

   network_client = NetworkManagementClient(credential, subscription_id)
   

4. Get the SecurityGroup object that contains the rule you want to remediate:

   security_group = network_client.security_groups.get(resource_group_name, security_group_name)
   

5. Get the SecurityRule object that contains the unrestricted RPC access:

   rpc_rule = next((rule for rule in security_group.security_rules if rule.name == 'Allow-RPC-Inbound'), None)
   

6. Update the SecurityRule object to restrict the RPC access:

   rpc_rule.access = 'Deny'
   rpc_rule.direction = 'Inbound'
   rpc_rule.protocol = 'TCP'
   rpc_rule.source_address_prefix = '*'
   rpc_rule.destination_address_prefix = '*'
   rpc_rule.destination_port_range = '135-139'
   

7. Update the SecurityGroup object in Azure with the new SecurityRule object:

   network_client.security_rules.create_or_update(resource_group_name, security_group_name, rpc_rule.name, rpc_rule)
   

With these steps, you can remediate the Unrestricted RPC Access misconfiguration in AZURE using Python.

Using Terraform

resource "azurerm_network_security_group" "EXISTING_NSG" {
  name                = "EXISTING_NSG_NAME"        # replace with your NSG name
  location            = "AZURE_REGION"             # e.g. "eastus"
  resource_group_name = "EXISTING_RESOURCE_GROUP"  # replace with your RG name
}

# Replace an existing “allow TCP 135 from 0.0.0.0/0” rule with a restricted one,
# or remove it entirely if RPC is not needed from the internet.

resource "azurerm_network_security_rule" "rpc_restricted" {
  name                        = "rpc-restricted"                 # must be unique in the NSG
  priority                    = 100                              # adjust if needed, 100–4096
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "135"
  source_address_prefixes     = ["ALLOWED_SOURCE_CIDR_1", "ALLOWED_SOURCE_CIDR_2"] 
  # e.g. ["10.0.0.0/16"] or specific on-prem/public IPs instead of "0.0.0.0/0"
  destination_address_prefix  = "*"
  resource_group_name         = azurerm_network_security_group.EXISTING_NSG.resource_group_name
  network_security_group_name = azurerm_network_security_group.EXISTING_NSG.name
}

If you previously had a rule on this NSG with destination_port_range = "135" and source_address_prefix = "0.0.0.0/0", remove or modify that rule so that no rule on this NSG allows TCP 135 from 0.0.0.0/0.

This change updates the NSG rule in-place (no NSG replacement), but it will immediately impact traffic to port 135 once applied.

For verification, terraform plan should show that the old rule allowing 0.0.0.0/0 to TCP 135 is being removed or updated, and that the new/updated rule only allows TCP 135 from the specified restricted CIDR ranges.