Description

Detects Azure Network Security Group rules that allow unrestricted internet access to MongoDB ports (27017, 27018, 27019). This poses a significant security risk as it could allow malicious actors to directly access MongoDB instances from the internet, potentially leading to unauthorized data access or database compromise.

Detection Strategy

• Reports a vulnerability when a Network Security Group rule allows inbound access from any IP address (0.0.0.0/0 or *) to MongoDB ports (27017, 27018, 27019)

• Checks if the rule's protocol is set to either TCP or * (all protocols)

• Evaluates both individual source address prefixes and source address prefix lists in the security rules