logo

Database

Azure Not Enforce Https

Description

Identifies Azure Storage Accounts that do not enforce HTTPS-only traffic. This vulnerability exposes the storage account to potential man-in-the-middle attacks and data interception since communications could occur over unencrypted HTTP connections.

Weakness:

372 - Use of an insecure channel - HTTP

Category: Information Collection

Detection Strategy

    Scans all Storage Accounts in the Azure subscription

    Checks if the 'enable_https_traffic_only' setting is disabled (set to false) for each Storage Account

    Reports a vulnerability if HTTPS-only traffic is not enforced, including the specific Storage Account ID and configuration state