Network misconfigurations

Sql database server allows ingress from any ip

Risk Level

Hazardous (3)

Platform(s)

Description

{AzureSqlDbServer}, SQL Database Server, allows ingress any ip (0.0.0.0/0). SQL Server includes a firewall that allows to define which connections are authorized and unauthorized. By default, for a SQL Server, a Firewall exists with StartIp of 0.0.0.0 and EndIP of 0.0.0.0 allowing access to all the Azure services. Additionally, a custom rule can be set up with StartIp of 0.0.0.0 and EndIP of 255.255.255.255 allowing access from any ip over the internet. In order to reduce the potential attacks of a SQL server, firewall rules should be defined with more restricted ip addresses by referencing the range of addresses available for a specific SQL Server.
  • Recommended Mitigation

    For each SQL server, click on Networking and disable public access or edit the firewall rules to limit access to only authorized connections.