Merge pull request #6640 from Checkmarx/kics-652

fix(query): lower properties protocol
Checkmarx · May 14, 2024 · 88283c4 · 88283c4
2 parents cfbb06d + f78f615
commit 88283c4
Show file tree

Hide file tree

Showing 4 changed files with 56 additions and 3 deletions.
diff --git a/...azureResourceManager/network_security_group_with_unrestricted_access_to_ssh/metadata.json b/...azureResourceManager/network_security_group_with_unrestricted_access_to_ssh/metadata.json
@@ -4,7 +4,7 @@
   "severity": "MEDIUM",
   "category": "Networking and Firewall",
   "descriptionText": "Port 22 (SSH) is exposed to the Internet",
-  "descriptionUrl": "https://docs.microsoft.com/en-us/azure/templates/microsoft.network/2020-07-01/networksecuritygroups?tabs=json#securityrulepropertiesformat-object",
+  "descriptionUrl": "https://learn.microsoft.com/en-us/azure/templates/microsoft.network/networksecuritygroups?pivots=deployment-language-bicep#securityrulepropertiesformat",
   "platform": "AzureResourceManager",
   "descriptionID": "97b6233c",
   "cloudProvider": "azure",

diff --git a/...es/azureResourceManager/network_security_group_with_unrestricted_access_to_ssh/query.rego b/...es/azureResourceManager/network_security_group_with_unrestricted_access_to_ssh/query.rego
@@ -12,7 +12,7 @@ CxPolicy[result] {
 	properties := value.properties.securityRules[x].properties
 
 	properties.access == "Allow"
-	properties.protocol == "Tcp"
+	lower(properties.protocol) == "tcp"
 	properties.direction == "Inbound"
 	arm_lib.contains_port(properties, 22)
 	arm_lib.source_address_prefix_is_open(properties)
@@ -38,7 +38,7 @@ CxPolicy[result] {
 	properties := typeInfo.properties
 
 	properties.access == "Allow"
-	properties.protocol == "Tcp"
+	lower(properties.protocol) == "tcp"
 	properties.direction == "Inbound"
 	arm_lib.contains_port(properties, 22)
 	arm_lib.source_address_prefix_is_open(properties)

diff --git a/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/positive7.json b/...esourceManager/network_security_group_with_unrestricted_access_to_ssh/test/positive7.json
@@ -0,0 +1,47 @@
+{
+    "properties": {
+        "template": {
+            "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+            "contentVersion": "2.0.0.0",
+            "apiProfile": "2019-03-01-hybrid",
+            "parameters": {},
+            "variables": {},
+            "functions": [],
+            "resources": [
+                {
+                    "name": "securitygroup",
+                    "type": "Microsoft.Network/networkSecurityGroups",
+                    "apiVersion": "2020-11-01",
+                    "location": "location1",
+                    "tags": {},
+                    "properties": {},
+                    "resources": [
+                        {
+                            "type": "securityRules",
+                            "apiVersion": "2020-11-01",
+                            "properties": {
+                                "description": "access to SSH",
+                                "protocol": "TCP",
+                                "sourcePortRange": "*",
+                                "destinationPortRanges": [
+                                    "22-23"
+                                ],
+                                "sourceAddressPrefix": "*",
+                                "destinationAddressPrefix": "*",
+                                "access": "Allow",
+                                "priority": 100,
+                                "direction": "Inbound"
+                            },
+                            "name": "sr"
+                        }
+                    ]
+                }
+            ],
+            "outputs": {}
+        },
+        "parameters": {}
+    },
+    "kind": "template",
+    "type": "Microsoft.Blueprint/blueprints/artifacts",
+    "name": "myTemplate"
+}
diff --git a/...network_security_group_with_unrestricted_access_to_ssh/test/positive_expected_result.json b/...network_security_group_with_unrestricted_access_to_ssh/test/positive_expected_result.json
@@ -34,5 +34,11 @@
     "severity": "MEDIUM",
     "line": 22,
     "fileName": "positive6.json"
+  },
+  {
+    "queryName": "Network Security Group With Unrestricted Access To SSH",
+    "severity": "MEDIUM",
+    "line": 22,
+    "fileName": "positive7.json"
   }
 ]