- PingSafe Knowledge Base
- Azure Knowledge Base
- Storage Accounts
-
Getting Started on PingSafe
-
Integrations
-
AWS Knowledge Base
- Amazon EKS
- Amazon RDS
- Amazon Kinesis
- AWS Organizations
- Amazon SQS (Simple Queue Service)
- AWS Cloudtrail
- AWS Certificate Manager
- AWS IAM
- AWS Workspaces
- Amazon S3
- AWS Systems Manager (AWS SSM)
- Amazon EC2
- Amazon Redshift
- Amazon EMR
- Amazon CloudFront
- Amazon DynamoDB
- Amazon Managed Workflows for Apache Airflow (MWAA)
- Amazon Route 53
- AWS Key Management Service (KMS)
- Amazon CloudWatch
- Amazon ElasticSearch
- AWS Database Migration Service
- AWS Config
- AWS X-Ray
- Amazon API Gateway
- Amazon Athena
- Amazon SageMaker
- AWS Elastic Load Balancing (ELB)
- AWS Lambda
- AWS Auto Scaling
- Amazon GuardDuty
- Amazon Elastic File System (Amazon EFS)
- Amazon Elastic Container Registry (Amazon ECR)
- AWS Glue
- Amazon Simple Notification Service (SNS)
- AWS Elastic Beanstalk
- AWS CodeBuild
- AWS Secrets Manager
- AWS Transfer Family
- Amazon Access Analyzer
-
Azure Knowledge Base
- Container Registries
- Azure Virtual Machines
- Network Security Group
- PostgreSQL
- Azure Monitor
- Azure Security Center
- SQL Databases
- SQL Servers
- Storage Accounts
- Azure Key Vaults
- Load Balancers
- App Services
- Azure Active Directory
- Activity Log
- Azure Policy
- Kubernetes Services
- Azure Resources
- Azure Cosmos DB
- CDN Profiles
- MySQL Servers
- Azure Virtual Network
- Azure Network Watcher
- Azure Cache for Redis
-
GCP Knowledge Base
- Google Cloud VPC
- Google Cloud IAM
- Google Cloud Load Balancing
- Google Cloud Logging
- Google Cloud Kubernetes Engine
- Google Cloud Pub/Sub
- Google Compute Engine
- Google Cloud Key Management Service (KMS)
- Google Cloud DNS
- Google Cloud Storage
- Google Cloud Dataproc
- Google Cloud SQL
- Google Cloud Spanner
- Google Cloud Deployment Manager
- Google Cloud BigQuery
- Google Cloud Dataflow
-
Digital Ocean Knowledge Base
Log Container Public Access
Risk Level: High
Description
The plugin will check that the user has not enabled anonymous access sets or subsets for the container logs. The access will allow people to anonymously access the log details of your container.
About the Service
Storage Accounts: An azure storage account is used to store the customer’s data objects such as files, queues, shares, etc. The storage accounts ensure high availability for the clients and allot a unique namespace for the storage data and are accessible from anywhere around the world using HTTP or HTTPS protocols.
Impact
In case the access level is not set to private, anyone from the internet can anonymously access the log details such as requests for successful or failed login or login requests using Oauth or SAS leading to breach in confidentiality and disclosure of sensitive information to threat actors.
Steps to Reproduce
- Log in to the Azure portal.
- Click on Storage accounts for Services.
- Select any one of the storage accounts to check for the issue.
- From the navigation bar, select Containers from Data storage.
- Check the value for Public Access level for ‘$log’ container (usually given at top of the list). If it is set to “blob” or “container”, check the Steps for remediation section.
- Repeat for other storage account’s logs container as well.
Steps for Remediation
- Log in to the Azure portal.
- Click on Storage accounts for Services.
- Select any one of the storage accounts to check for the issue.
- From the navigation bar, select Containers from Data storage.
- Select the ‘$log’ container to set the access level as private.
- Go to Change access level and click on the drop-down menu. Select private (no anonymous access).
- Repeat for other storage account’s logs container as well.
Please feel free to reach out to support@pingsafe.com with any questions that you may have.
Thanks
PingSafe Support