Lack of protection against deletion - Azure Key Vault
Description
Some Azure Key Vaults instances do not enable properties that allow secrets to be recovered in the event of accidental deletion or by malicious actors.
Impact
Delete sensitive secrets by accident with no chance of recovery
Recommendation
Enable the properties EnableSoftDelete and EnablePurgeProtection in every Azure Key Vault (AKV) instance.
Threat
Authenticated attacker from the Internet with write permissions in the vault
Expected Remediation Time
⌚ 20 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the vulnerability.
Base
- Attack vector: N
- Attack complexity: L
- Privileges required: H
- User interaction: N
- Scope: U
- Confidentiality: N
- Integrity: N
- Availability: H
Temporal
- Exploit code madurity: P
- Remediation level: O
- Report confidence: C
Result
- Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
- Score:
- Base: 4.9
- Temporal: 4.4
- Severity:
- Base: Medium
- Temporal: Medium
Code Examples
Compliant code
All resources have protection against deletion enabled
resource "azurerm_key_vault" "not_vulnerable" {
name = "examplekeyvault"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
tenant_id = data.azurerm_client_config.current.tenant_id
soft_delete_retention_days = 7
soft_delete_enabled = true
purge_protection_enabled = true
}
Non compliant code
The resource does not have any protection against deletion enabled
resource "azurerm_key_vault" "vulnerable" {
name = "examplekeyvault"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
tenant_id = data.azurerm_client_config.current.tenant_id
}
Using the Azure CLI, the following command checks production Azure Key Vaults are recoverable
$ az keyvault show
--name {keyvault_id}
--query 'properties.{"enableSoftDelete":enableSoftDelete,"enablePurgeProtection":enablePurgeProtection}'
If the command output returns null for both "enablePurgeProtection" and "enableSoftDelete" configuration attributes, the verified Microsoft Azure Key Vault instance and its objects are not recoverable, which means that the resource does not have protection against deletion.
Requirements
Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.