Description

Detects when Azure Shared Access Signatures (SAS) are configured to allow HTTP protocol instead of enforcing HTTPS. This creates a security risk as sensitive SAS tokens could be exposed through unencrypted network traffic, potentially allowing attackers to intercept and misuse access credentials.

Detection Strategy

• Identifies calls to GetSharedAccessSignature() method in C# code

• Checks if the method is called on Azure storage-related objects (like CloudBlobContainer, CloudQueue etc.)

• Verifies if the SAS token generation allows HTTP protocol in its configuration

• Reports a vulnerability when a SAS token is generated without enforcing HTTPS-only access

Vulnerable code example

using Microsoft.WindowsAzure.Storage;
using Microsoft.WindowsAzure.Storage.File;

public class StorageExample {
    public string GenerateInsecureFileAccess() {
        CloudFile file = new CloudFile(new Uri("https://example.com/file"));
        SharedAccessFilePolicy policy = new SharedAccessFilePolicy();
        // Vulnerable: Using HttpsOrHttp allows insecure HTTP protocol...

✅ Secure code example

using Microsoft.WindowsAzure.Storage;
using Microsoft.WindowsAzure.Storage.File;
using System;

public class StorageExample {
    public string GenerateSecureFileAccess() {
        // Validate URL and throw exception if invalid
        var fileUrl = Environment.GetEnvironmentVariable("AZURE_FILE_URL");...