Description

Identifies Azure PostgreSQL Flexible Servers that have SSL/TLS encryption disabled for client connections. When SSL enforcement is disabled, database connections can be established without encryption, potentially exposing sensitive data in transit to network-based attacks.

Detection Strategy

• Examines the 'require_secure_transport' configuration setting for each PostgreSQL Flexible Server

• Reports a vulnerability if the 'require_secure_transport' setting is set to 'off'

• The server must enforce encrypted connections by setting 'require_secure_transport' to 'on'