azure-rediscache-authnotrequired-exposed-internet

Cache with authnotrequired=true and publicNetworkAccess=Enabled allows anonymous internet access to the Redis data-plane with full commands.

derived azure emits ExposedToInternet

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Cache`
target type	`AnonymousIdentity`
source	`?cache`
target	`<AnonymousIdentity>`
conditions	`network_reachability`
state logic	if ?cache.properties.publicNetworkAccess == 'Disabled': DO NOT EMIT (service-level flag blocks the endpoint); elif ?cache.properties.redisConfiguration.authnotrequired != 'yes': DO NOT EMIT (authentication is required); else ACTIVE: any internet host can connect to the Redis data-plane endpoint on port 6380 (or 6379 if enableNonSslPort=true) without providing credentials and issue any Redis command. This grants full read, write, delete, and CONFIG access to an unauthenticated attacker. This is an extremely rare but catastrophic misconfiguration.

source type

Cache

target type

AnonymousIdentity

source

?cache

target

<AnonymousIdentity>

conditions

network_reachability

state logic

if ?cache.properties.publicNetworkAccess == 'Disabled': DO NOT EMIT (service-level flag blocks the endpoint); elif ?cache.properties.redisConfiguration.authnotrequired != 'yes': DO NOT EMIT (authentication is required); else ACTIVE: any internet host can connect to the Redis data-plane endpoint on port 6380 (or 6379 if enableNonSslPort=true) without providing credentials and issue any Redis command. This grants full read, write, delete, and CONFIG access to an unauthenticated attacker. This is an extremely rare but catastrophic misconfiguration.

Narrative

{cache.name} has authentication disabled (authnotrequired=yes) and is exposed to the public internet (publicNetworkAccess=Enabled). Any internet attacker can connect and issue full Redis commands: reading all cached data, injecting malicious data, flushing the cache, or modifying Redis runtime config - all without credentials. This is a critical misconfiguration.

Raw rule rules/derived/azure/rediscache.yaml

id: azure-rediscache-authnotrequired-exposed-internet
emits: ExposedToInternet
description: Cache with authnotrequired=true and publicNetworkAccess=Enabled allows anonymous internet
  access to the Redis data-plane with full commands.
match:
- - cache: null
where:
- node_type(?cache) == Cache
- ?cache.provider_type == 'Microsoft.Cache/redis'
- ?cache.properties.redisConfiguration.authnotrequired == 'yes'
- ?cache.properties.publicNetworkAccess != 'Disabled'
emit:
  source_type: Cache
  target_type: AnonymousIdentity
  source: ?cache
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - network_reachability
  state_logic: 'if ?cache.properties.publicNetworkAccess == ''Disabled'': DO NOT EMIT (service-level flag
    blocks the endpoint); elif ?cache.properties.redisConfiguration.authnotrequired != ''yes'': DO NOT
    EMIT (authentication is required); else ACTIVE: any internet host can connect to the Redis data-plane
    endpoint on port 6380 (or 6379 if enableNonSslPort=true) without providing credentials and issue any
    Redis command. This grants full read, write, delete, and CONFIG access to an unauthenticated attacker.
    This is an extremely rare but catastrophic misconfiguration.'
  confidence: '0.99'
  derived_from:
  - <cache.properties.redisConfiguration.authnotrequired property>
  - <cache.properties.publicNetworkAccess property>
  false_positive_note: This is a very rare configuration and requires explicit action to enable (authnotrequired
    defaults to 'no'). If both properties are set as detected, the exposure is real. High confidence.
    Cross-check with documentation or compliance policies to confirm this is not an intentional shared/testing
    cache.
  narrative: "{cache.name} has authentication disabled (authnotrequired=yes) and is exposed to the public\
    \ internet (publicNetworkAccess=Enabled). Any internet attacker can connect and issue full Redis commands:\
    \ reading all cached data, injecting malicious data, flushing the cache, or modifying Redis runtime\
    \ config \u2014 all without credentials. This is a critical misconfiguration."