Description

Identifies Azure Network Security Groups (NSGs) that allow unrestricted SSH access (port 22) from any IP address. This misconfiguration could enable unauthorized remote access to Azure resources, posing a significant security risk by exposing SSH endpoints to the public internet.

Detection Strategy

• Scans all Network Security Group rules in the Azure subscription

• Identifies rules that allow inbound traffic on port 22 (SSH)

• Checks if the rule's source address prefix is overly permissive (like '*', '0.0.0.0/0', 'Internet', etc.)

• Reports a vulnerability when an NSG rule allows SSH access from any source IP address over TCP or any (*) protocol