Networking

Rule Name	AppSec Rule ID	Severity
Alibaba Cloud Kubernetes does not install plugin Terway or Flannel to support standard policies misconfiguration detected in code	APPSEC_ALI_26	LOW
Alibaba Cloud Cypher Policy is not secured misconfiguration detected in code	APPSEC_ALI_33	LOW
Alibaba Cloud MongoDB is not deployed inside a VPC misconfiguration detected in code	APPSEC_ALI_41	LOW
AWS EKS cluster security group overly permissive to all traffic misconfiguration detected in code	APPSEC_AWS_38	LOW
AWS CloudFront web distribution with AWS Web Application Firewall (AWS WAF) service disabled misconfiguration detected in code	APPSEC_AWS_68	LOW
AWS EKS node group have implicit SSH access from 0.0.0.0/0 misconfiguration detected in code	APPSEC_AWS_100	HIGH
Deletion protection disabled for load balancer misconfiguration detected in code	APPSEC_AWS_113	MEDIUM
VPC endpoint service is not configured for manual acceptance misconfiguration detected in code	APPSEC_AWS_123	LOW
Elastic load balancers do not use SSL Certificates provided by AWS Certificate Manager misconfiguration detected in code	APPSEC_AWS_127	HIGH
ALB does not drop HTTP headers misconfiguration detected in code	APPSEC_AWS_131	MEDIUM
AWS Elastic Load Balancer (Classic) with cross-zone load balancing disabled misconfiguration detected in code	APPSEC_AWS_138	LOW
Default VPC is planned to be provisioned misconfiguration detected in code	APPSEC_AWS_148	LOW
AWS Elastic Load Balancer v2 with deletion protection feature disabled misconfiguration detected in code	APPSEC_AWS_150	LOW
AWS Elastic Load Balancer v2 (ELBv2) with cross-zone load balancing disabled misconfiguration detected in code	APPSEC_AWS_152	LOW
WAF enables message lookup in Log4j2 misconfiguration detected in code	APPSEC_AWS_192	HIGH
AWS RDS security groups are not defined misconfiguration detected in code	APPSEC_AWS_198	LOW
AWS ELB Policy uses some unsecure protocols misconfiguration detected in code	APPSEC_AWS_213	LOW
AWS Cloudfront distribution is disabled misconfiguration detected in code	APPSEC_AWS_216	LOW
AWS Elasticsearch uses the default security group misconfiguration detected in code	APPSEC_AWS_248	LOW
ALB is not configured with the defensive or strictest desync mitigation mode misconfiguration detected in code	APPSEC_AWS_328	HIGH
Network firewalls do not have deletion protection enabled misconfiguration detected in code	APPSEC_AWS_344	HIGH
Transfer server does not force secure protocols. misconfiguration detected in code	APPSEC_AWS_357	HIGH
AWS CloudFront web distribution with geo restriction disabled misconfiguration detected in code	APPSEC_AWS_374	LOW
Route 53 domains do not have transfer lock protection misconfiguration detected in code	APPSEC_AWS_377	LOW
Azure AKS cluster network policies are not enforced misconfiguration detected in code	APPSEC_AZURE_7	LOW
Azure RDP Internet access is not restricted misconfiguration detected in code	APPSEC_AZURE_9	HIGH
CORS allows resources to access function apps misconfiguration detected in code	APPSEC_AZURE_62	LOW
Azure Function App doesn't use HTTP 2.0 misconfiguration detected in code	APPSEC_AZURE_67	LOW
Azure App Services Remote debugging is enabled misconfiguration detected in code	APPSEC_AZURE_72	MEDIUM
Azure container container group is not deployed into a virtual network misconfiguration detected in code	APPSEC_AZURE_98	LOW
API management services do not use virtual networks misconfiguration detected in code	APPSEC_AZURE_107	LOW
Key vault does not allow firewall rules settings misconfiguration detected in code	APPSEC_AZURE_109	MEDIUM
AKS is not enabled for private clusters misconfiguration detected in code	APPSEC_AZURE_115	LOW
Azure application gateway does not have WAF enabled misconfiguration detected in code	APPSEC_AZURE_120	LOW
Azure Front Door does not have the Azure Web application firewall (WAF) enabled misconfiguration detected in code	APPSEC_AZURE_121	LOW
Application gateway does not use WAF in Detection or Prevention modes misconfiguration detected in code	APPSEC_AZURE_122	LOW
Azure front door does not use WAF in Detection or Prevention modes misconfiguration detected in code	APPSEC_AZURE_123	LOW
Azure Front Door Web application firewall (WAF) policy rule for Remote Command Execution is disabled misconfiguration detected in code	APPSEC_AZURE_133	LOW
Azure Application Gateway Web application firewall (WAF) policy rule for Remote Command Execution is disabled misconfiguration detected in code	APPSEC_AZURE_135	LOW
Firewall policy does not have IDPS mode set to deny misconfiguration detected in code	APPSEC_AZURE_220	HIGH
Azure Container Registry dedicated data endpoint is disabled misconfiguration detected in code	APPSEC_AZURE_237	LOW
Azure Batch Account configured with overly permissive network access misconfiguration detected in code	APPSEC_AZURE_248	HIGH
Azure Storage Sync Service configured with overly permissive network access misconfiguration detected in code	APPSEC_AZURE_250	HIGH
Azure VM disk configured with public network access misconfiguration detected in code	APPSEC_AZURE_251	HIGH
GCP Kubernetes Engine Clusters have Network policy disabled misconfiguration detected in code	APPSEC_GCP_12	LOW
GCP Kubernetes Engine Clusters have Master authorized networks disabled misconfiguration detected in code	APPSEC_GCP_20	LOW
GCP Kubernetes Engine Clusters have Alias IP disabled misconfiguration detected in code	APPSEC_GCP_23	LOW
GCP Kubernetes Engine private cluster has private endpoint disabled misconfiguration detected in code	APPSEC_GCP_25	MEDIUM
GCP Kubernetes cluster intra-node visibility disabled misconfiguration detected in code	APPSEC_GCP_61	LOW
GCP Kubernetes Engine Clusters not configured with private nodes feature misconfiguration detected in code	APPSEC_GCP_64	LOW
Containers wishing to share host network namespace admitted misconfiguration detected in code	APPSEC_K8S_4	MEDIUM
Containers share the host network namespace misconfiguration detected in code	APPSEC_K8S_19	MEDIUM
hostPort is specified misconfiguration detected in code	APPSEC_K8S_26	LOW
The --kubelet-https argument is not set to True misconfiguration detected in code	APPSEC_K8S_71	HIGH
The API server does not make use of strong cryptographic ciphers misconfiguration detected in code	APPSEC_K8S_105	HIGH
The --bind-address argument for controller managers is not set to 127.0.0.1 misconfiguration detected in code	APPSEC_K8S_113	HIGH
The --bind-address argument is not set to 127.0.0.1 misconfiguration detected in code	APPSEC_K8S_115	HIGH
The --auto-tls argument is set to True misconfiguration detected in code	APPSEC_K8S_118	HIGH
The --make-iptables-util-chains argument is not set to True misconfiguration detected in code	APPSEC_K8S_145	LOW
The --tls-cert-file and --tls-private-key-file arguments for Kubelet are not set appropriately misconfiguration detected in code	APPSEC_K8S_148	HIGH
Kubelet does not use strong cryptographic ciphers misconfiguration detected in code	APPSEC_K8S_151	LOW
NGINX Ingress annotation snippets contains LUA code execution misconfiguration detected in code	APPSEC_K8S_152	LOW
NGINX Ingress has annotation snippets misconfiguration detected in code	APPSEC_K8S_153	LOW
NGINX Ingress has annotation snippets which contain alias statements misconfiguration detected in code	APPSEC_K8S_154	LOW
OCI Network Security Groups (NSG) has stateful security rules misconfiguration detected in code	APPSEC_OCI_21	MEDIUM
OCI Data Catalog configured with overly permissive network access misconfiguration detected in code	APPSEC_OCI_23	HIGH
OpenStack firewall rule does not have destination IP configured misconfiguration detected in code	APPSEC_OPENSTACK_5	LOW
Plain-text management HTTP enabled for Interface Management Profile in Palo Alto Networks devices misconfiguration detected in code	APPSEC_PAN_2	MEDIUM
Plain-text management Telnet enabled for Interface Management Profile in Palo Alto Networks devices misconfiguration detected in code	APPSEC_PAN_3	MEDIUM
Disable Server Response Inspection (DSRI) enabled in security policies for Palo Alto Networks devices misconfiguration detected in code	APPSEC_PAN_4	MEDIUM
Security rule allows any application on Palo Alto Networks devices misconfiguration detected in code	APPSEC_PAN_5	MEDIUM
Security rule permits any service on Palo Alto Networks devices misconfiguration detected in code	APPSEC_PAN_6	LOW
Security Rule in Palo Alto Networks devices with overly broad Source and Destination IPs misconfiguration detected in code	APPSEC_PAN_7	LOW
IPsec profile uses insecure authentication algorithms on Palo Alto Networks devices misconfiguration detected in code	APPSEC_PAN_12	MEDIUM
IPsec profile uses insecure authentication protocols on Palo Alto Networks devices misconfiguration detected in code	APPSEC_PAN_13	MEDIUM
Security zone on Palo Alto Networks devices does not have an associated Zone Protection Profile misconfiguration detected in code	APPSEC_PAN_14	LOW
Include ACL (Access Control List) not defined for a security zone in Palo Alto Networks devices with User-ID enabled misconfiguration detected in code	APPSEC_PAN_15	LOW
Security rules apply to all zones on Palo Alto Networks devices misconfiguration detected in code	APPSEC_PAN_17	MEDIUM
AWS AppSync is not protected by WAF misconfiguration detected in code	APPSEC2_AWS_33	LOW
AWS NAT Gateways are not utilized for the default route misconfiguration detected in code	APPSEC2_AWS_35	LOW
AWS ACM Certificate with wildcard domain name misconfiguration detected in code	APPSEC2_AWS_71	LOW
AWS Load Balancers do not use strong ciphers misconfiguration detected in code	APPSEC2_AWS_74	LOW
AWS Lambda function URL having overly permissive cross-origin resource sharing permissions misconfiguration detected in code	APPSEC2_AWS_75	MEDIUM
Azure Automation account configured with overly permissive network access misconfiguration detected in code	APPSEC2_AZURE_24	MEDIUM
Azure MySQL Flexible Server not configured with private endpoint misconfiguration detected in code	APPSEC2_AZURE_56	MEDIUM
PostgreSQL Flexible Server not configured with private endpoint misconfiguration detected in code	APPSEC2_AZURE_57	MEDIUM
GCP project is configured with legacy network misconfiguration detected in code	APPSEC2_GCP_2	MEDIUM
Vertex AI workbench instances are not private misconfiguration detected in code	APPSEC2_GCP_28	MEDIUM
GCP public-facing (external) regional load balancer using HTTP protocol misconfiguration detected in code	APPSEC2_GCP_37	MEDIUM
GCP public-facing (external) global load balancer using HTTP protocol misconfiguration detected in code	APPSEC2_GCP_38	MEDIUM
IBM Cloud Virtual Private Cloud (VPC) classic access is enabled in Terraform misconfiguration detected in code	APPSEC2_IBM_2	HIGH