Skip to main content

lacework-global-587

9.10 Disable File Transfer Protocol (FTP) deployments (Automated)​

Profile Applicability​

• Level 1

Description​

By default, it is possible to deploy Azure Functions, Web, and API Services over FTP. If you require FTP for an essential deployment workflow, use File Transfer Protocol Secure (FTPS) for FTP login for all App Service Apps and Functions.

Rationale​

Azure FTP deployment endpoints are public. An attacker listening to traffic on a wifi network used by a remote employee or a corporate network could see login traffic in clear-text which would then grant them full control of the code base of the app or service. This finding is more severe if User Credentials for deployment are set at the subscription level rather than using the default Application Credentials which are unique per App.

Impact​

Any deployment workflows that rely on FTP or FTPs rather than the WebDeploy or HTTPs endpoints may be affected.

Audit​

From Azure Portal​

  1. Go to the Azure Portal
  2. Select App Services
  3. Click on an app
  4. Select Settings and then Configuration
  5. Under General Settings, for the Platform Settings, the FTP state should not be set to All allowed

From Azure CLI​

List webapps to obtain the ids.

az webapp list

List the publish profiles to obtain the username, password and ftp server url.

az webapp deployment list-publishing-profiles --ids <ids>
{
 "publishUrl": <URL_FOR_WEB_APP>,
 "userName": <USER_NAME>,
 "userPWD": <USER_PASSWORD>,
}

From Azure PowerShell​

List all Web Apps:

Get-AzWebApp

For each app:

Get-AzWebApp -ResourceGroupName <resource group name> -Name <app name> | Select-Object -ExpandProperty SiteConfig

In the output, look for the value of FtpsState. If its value is AllAllowed the setting is out of compliance. Any other value is considered in compliance with this check.

Remediation​

From Azure Portal​

  1. Go to the Azure Portal.
  2. Select App Services.
  3. Click an app.
  4. Select Settings and then Configuration.
  5. Under General Settings, for the Platform Settings, set the FTP state to Disabled or FTPS Only.

From Azure CLI​

For each out of compliance application, run the following choosing either 'disabled' or 'FtpsOnly' as appropriate:

az webapp config set --resource-group <resource group name> --name <app name> --ftps-state [disabled|FtpsOnly]

From Azure PowerShell​

For each out of compliance application, run the following:

Set-AzWebApp -ResourceGroupName <resource group name> -Name <app name> -FtpsState <Disabled or FtpsOnly>

References​

https://docs.microsoft.com/en-us/azure/app-service/deploy-ftp)
https://docs.microsoft.com/en-us/azure/app-service/overview-security)
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-data-protection#dp-4-encrypt-sensitive-information-in-transit
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-posture-vulnerability-management#pv-7-rapidly-and-automatically-remediate-software-vulnerabilities

Last updated on