azure-rediscache-public-open-firewall-rule

id: azure-rediscache-public-open-firewall-rule
emits: ExposedToInternet
description: "A firewall rule allowing 0.0.0.0\u2013255.255.255.255 explicitly exposes the Redis data-plane\
  \ endpoint to the entire public internet."
match:
- - cache: null
  - Contains
  - firewallRule: null
where:
- node_type(?cache) == Cache
- ?cache.provider_type == 'Microsoft.Cache/redis'
- ?cache.properties.publicNetworkAccess != 'Disabled'
- node_type(?firewallRule) == Firewall
- ?firewallRule.provider_type == 'Microsoft.Cache/redis/firewallRules'
- ?firewallRule.properties.startIP == '0.0.0.0'
- ?firewallRule.properties.endIP == '255.255.255.255'
emit:
  source_type: Cache
  target_type: AnonymousIdentity
  source: ?cache
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - network_reachability
  state_logic: "if ?cache.properties.publicNetworkAccess == 'Disabled': DO NOT EMIT (the service-level\
    \ flag overrides all firewallRules); elif ?firewallRule.properties.endIP != '255.255.255.255': DO\
    \ NOT EMIT for this rule pattern (other rules patterns are handled separately); else ACTIVE: the explicit\
    \ 0.0.0.0\u2013255.255.255.255 rule allows all internet IPv4 addresses to reach the Redis endpoint\
    \ on port 6380 (SSL). This rule pattern is created by the Azure portal \"Allow access from all networks\"\
    \ checkbox and is deliberately permissive. Key-based authentication is still required unless authnotrequired=yes.\
    \ NOTE: Azure Cache for Redis ARM API property names are 'startIP' and 'endIP' (not 'startIpAddress'/'endIpAddress'\
    \ as in Azure SQL Server firewall rules)."
  confidence: '0.95'
  derived_from:
  - "<Contains edge_id (cache \u2192 firewallRule)>"
  - <firewallRule.properties.startIpAddress/endIpAddress>
  - <cache.properties.publicNetworkAccess>
  false_positive_note: "publicNetworkAccess=Disabled is a service-level guard that overrides all firewallRules\
    \ \u2014 check it first. The rule must have BOTH startIP=0.0.0.0 AND endIP=255.255.255.255 to qualify;\
    \ partial ranges (e.g. 10.0.0.0 range) are not internet exposure. Property names are 'startIP' and\
    \ 'endIP' per the Azure Cache for Redis ARM API (not 'startIpAddress'/'endIpAddress' as in SQL Server).\
    \ Unlike azure-rediscache-public-no-firewall (empty rules), this rule is an intentional portal action\
    \ \u2014 higher confidence (0.95 vs 0.93). The network exposure is TCP reachability only; data access\
    \ requires the Redis key."
  narrative: "{cache.name} has an explicit firewall rule allowing all IPv4 addresses (0.0.0.0\u2013255.255.255.255).\
    \ The Redis data-plane port 6380 is reachable from the entire public internet. Combined with key possession\
    \ (via listKeys/action), an attacker has both the network path and credentials to access all cached\
    \ data."