Description

Detects Azure Firewall application rules that are configured with overly permissive source IP addresses. Such configurations can expose services to access from any IP address on the internet, potentially allowing unauthorized access to protected resources.

Detection Strategy

• Scans all application rule collections defined in Azure Firewalls

• Checks the source_addresses field in each application rule

• Flags rules that use overly permissive IP ranges (like 0.0.0.0/0) in their source address configuration

• Reports a vulnerability when any application rule allows unrestricted access from broad IP ranges