Web Apps Remote Debugging Enabled

Risk Level: High

Description  

This plugin ensures that Azure Web Apps have remote debugging disabled. The remote debugging feature requires specific inbound ports to be opened which can increase chances of unauthorized access.

About the Service

App Services: The app services at azure offers to host web applications, the REST API and backend services for mobile and web applications. Hosting web apps on Azure lets users focus on managing the application and its data. 

Impact 

Remote debugging requires some inbound ports to be opened, while this may not directly cause any harm to the system but these open ports can be a medium for malware to get into the system. 

Steps to Reproduce

1. Login to the Azure portal.
2. Click on App Services.
   
3. Select an App Service plan from the listed apps.
   
4. Click on Configuration under Settings.
   
5. Go to the General settings section.
   
6. In the Debugging section, if the value of Remote Debugging is set to ‘On’, follow the steps given in the Steps for Remediation section to solve the problem. 
   
7. Repeat the process for the rest of the web applications and check for the issue.

Steps for Remediation

1. Login to the Azure portal.
2. Click on App Services.
   
3. Select an App Service plan from the listed apps.
   
4. Click on Configuration under Settings.
   
5. Go to the General settings section.
   
6. In the Debugging section click on the ‘Off’ button in front of Remote Debugging and disable the feature.
   
7. Repeat this process for all the other web apps as well.

Please feel free to reach out to support@pingsafe.ai with any questions that you may have.

Thanks

PingSafe Support