Azure Ansible Misconfiguration: Improper Security Group Network Access Control

The Ansible task defines a network security group that allows access to administrative services.

Overly broad configurations expose systems and broaden an organization's attack surface. Services open to interaction with the public are subjected to almost continuous scanning and probing by attackers.

This is especially problematic when a zero-day exploit for an exposed service is discovered and published (e.g. Heartbleed). Attackers can actively pursue and search for unpatched and exposed systems to exploit.

Example 1: The following example Ansible task allows unrestricted inbound traffic to a range of ports, including the RDP service port (3389).

- name: testFWRule
    azure_rm_securitygroup:
        resource_group: testRG
        name: test
        rules:
        - name: rule001
            priority: 100
            direction: Inbound
            access: Allow
            protocol: "*"
            source_port_range: "*"
            destination_port_range: "3388-3398"
            source_address_prefix: "*"
            destination_address_prefix: "*"
        - name: rule002
            priority: 100
            direction: Inbound
            access: Allow
            protocol: "*"
            source_port_range: "*"
            destination_port_range: 22
            source_address_prefix: "*"
            destination_address_prefix: "*"