Description

Detects Azure Network Security Groups (NSGs) that allow unrestricted SMTP access from any source IP address. This misconfiguration could enable malicious actors to abuse email servers or conduct email-based attacks by connecting to port 25 from anywhere on the internet.

Detection Strategy

• Examines each Network Security Group's security rules for inbound access configurations

• Identifies rules that allow access to SMTP port 25 via TCP protocol

• Flags rules where source IP address is set to any ('*', '0.0.0.0/0', 'Internet', etc.)

• Reports a vulnerability when unrestricted SMTP access is found in any security rule