Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

False Positive reporting of Insecure TLS Version being used #1682

Open
kovacs-levent opened this issue Nov 28, 2024 · 0 comments
Open

False Positive reporting of Insecure TLS Version being used #1682

kovacs-levent opened this issue Nov 28, 2024 · 0 comments
Labels
bug Something isn't working potential Unconfirmed issue

Comments

@kovacs-levent
Copy link

kovacs-levent commented Nov 28, 2024

Describe the bug

Insecure TLS Version rule for Azure providers is incorrectly reporting Insecure TLS version. The check only does a strict equality check for 1.2, and it reports TLS 1.3 workloads as being non-compliant with the rule.

"conditions": [
        "and",
        [
            "appservice.subscriptions.id.web_apps.id.minimum_tls_version_supported",
            "notEqual",
            "1.2"
        ]
    ]

I think here you'd want to add 1.3 as a valid value too.

To Reproduce

Run ScoutSuite on any Azure environment with an app service which has TLS 1.3 configured as minimum TLS version, but I ran the check with these parameters on our own tenant which has such service configured.

python3 scout.py azure --cli --all-subscriptions --report-name ~/azure_apis/azure_report.pdf

Additional context

It is not necessarily a bug, just a false positive report, which can be easily avoided. I can create PR for this later, since it's easy fix.

@kovacs-levent kovacs-levent added bug Something isn't working potential Unconfirmed issue labels Nov 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working potential Unconfirmed issue
Projects
None yet
Development

No branches or pull requests

1 participant