Description

Detects Azure Network Security Groups (NSGs) that allow inbound traffic from any public IP address. This misconfiguration could expose Azure resources to unauthorized access from the internet by having overly permissive inbound rules with public source addresses.

Detection Strategy

• Scans each Network Security Group's inbound security rules

• Reports a vulnerability when an inbound rule has: Direction set to 'Inbound', Access set to 'Allow', and source address prefixes/prefix includes public IP ranges

• Specifically looks for source addresses like '0.0.0.0/0', '*', 'Internet', or other public IP ranges that allow unrestricted public access