Description

Detects Azure Network Security Groups (NSGs) that use port ranges in their security rules instead of specific ports. Using port ranges can create overly permissive network access controls that may expose services to unauthorized access and increase the attack surface.

Detection Strategy

• Scans all Network Security Group rules in the Azure subscription

• Reports a vulnerability when a security rule uses destination_port_ranges or destination_port_range with multiple ports

• Examines both the destination_port_ranges array and destination_port_range string fields in NSG rules