Description

Detects Azure App Services that do not have mutual TLS (client certificate authentication) enabled. When mutual TLS is disabled, the web app cannot validate client certificates, potentially allowing unauthorized clients to connect and increasing the risk of unauthorized access.

Detection Strategy

• Scans all Azure App Services in the subscription

• Checks if the 'client_cert_enabled' setting is set to false or not configured

• Reports a vulnerability for each App Service that does not have client certificate authentication enabled