Azure Network Security Group having Inbound rule overly permissive to all traffic on UDP protocol mi

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_77
Category - Subcategory	Public Exposure - Ingress Controls
Provider	AZURE
Severity	MEDIUM
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	d979e41c-a50d-11e8-98d0-529269fb1459

Impact

Disable Internet exposed UDP ports on network security groups. The potential security problem with broadly exposing UDP services over the Internet is that attackers can use DDoS amplification techniques to reflect spoofed UDP traffic from Azure Virtual Machines. The most common types of these attacks use exposed DNS, NTP, SSDP, SNMP, CLDAP and other UDP-based services as amplification source for disrupting services of other machines on the Azure Virtual Network or even attack networked devices outside of Azure.

How to Fix

Resource: azurerm_network_security_group

• Arguments: protocol [source,go]

---

resource "azurerm_network_security_group" "example" {

security_rule { name = "test123" priority = 100 direction = "Inbound"

• access = "Deny"

• protocol = "Udp" source_port_range = "" destination_port_range = "" source_address_prefix = "" destination_address_prefix = "" } ... }

---