feat(scanner): add AZ-NET-015 public DNS zone enumeration rule#106
feat(scanner): add AZ-NET-015 public DNS zone enumeration rule#106aav-wh wants to merge 1 commit into
Conversation
- Add scanner/rules/az_net_015.py to detect public DNS zones - Add get_dns_zones() to azure_client.py using DnsManagementClient - Add playbooks/cli/fix_az_net_015.sh remediation script - Add azure-mgmt-dns==8.0.0 to requirements.txt - Update all 4 compliance framework JSONs with AZ-NET-015 mappings
m-khan-97
left a comment
m-khan-97
left a comment
There was a problem hiding this comment.
Thanks for the contribution. I am reviewing the open network-rule PRs as a batch so we avoid duplicate or noisy rules.
Please update/rebase this branch against the latest dev first, because the PR is currently conflicting.
For the rule logic: public DNS zones are not automatically a misconfiguration. Many legitimate public-facing services require public DNS. Before this can merge, the detection needs to be narrowed so it avoids noisy false positives. Good directions would be to flag public DNS records that expose private RFC1918 IPs, internal-looking hostnames such as admin, vpn, db, internal, dev, or zones/records missing an explicit metadata exception for intentionally public services.
Also please re-check the CIS mapping. The current mapping to CIS 9.2 / NSG rules does not obviously match public DNS zone exposure.
Once the branch is conflict-free and the rule is more precise, this can be re-reviewed.
2 participants
What does this PR do?
Adds AZ-NET-015 scanner rule to detect Azure DNS zones configured as Public, which expose DNS records to internet enumeration.
Type of change
Rule details
Testing
Related issue
Closes #105
Checklist