Azure CName Records Vulnerable
More Info:
Ensure Azure CName Records are not vulnerableRisk Level
MediumAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the CName Records vulnerability in Azure, follow these steps using the Azure console:
- Sign in to the Azure portal (https://portal.azure.com) using your credentials.
- Navigate to the Azure DNS service by searching for “DNS” in the search bar at the top of the portal and selecting “DNS zones” from the results.
- Select the DNS zone that contains the vulnerable CName record.
- In the DNS zone overview, locate the CName record that needs to be remediated.
- Click on the CName record to open its settings.
- Review the CName record and ensure it is pointing to a trusted and valid destination.
- If the CName record is pointing to an unauthorized or suspicious destination, click on the “Edit” button to modify the record.
- In the edit mode, update the CName record to the correct and trusted destination.
- Save the changes by clicking on the “Save” button.
- After saving the changes, verify that the CName record is now pointing to the intended destination.
- Repeat the above steps for any other vulnerable CName records in the DNS zone.
Using CLI
Using CLI
To remediate the Azure CName Records Vulnerability, you can follow the steps below using Azure CLI:
-
Install and configure Azure CLI:
- Install Azure CLI by following the instructions provided in the official documentation: https://docs.microsoft.com/en-us/cli/azure/install-azure-cli
- Once installed, authenticate with your Azure account using the command:
az login
-
Identify the affected CName records:
- List all the DNS zones in your Azure subscription using the command:
az network dns zone list - Identify the DNS zone that contains the vulnerable CName record.
- List all the DNS zones in your Azure subscription using the command:
-
Delete the vulnerable CName record:
- Use the command
az network dns record-set cname deleteto delete the CName record. - Specify the DNS zone name and the name of the CName record to delete.
- Example command:
az network dns record-set cname delete -g <resource_group_name> -z <dns_zone_name> -n <cname_record_name>
- Use the command
-
Verify the deletion:
- Confirm that the CName record has been successfully deleted by listing the DNS records in the DNS zone using the command:
az network dns record-set list -g <resource_group_name> -z <dns_zone_name>
- Confirm that the CName record has been successfully deleted by listing the DNS records in the DNS zone using the command:
- Repeat steps 3 and 4 for all affected CName records.
Using Python
Using Python
To remediate the CName Records vulnerability in Azure Network using Python, follow these steps:
-
Install the required Python packages:
-
Import the necessary modules:
-
Authenticate with Azure using your credentials:
-
Get the list of DNS zones in your Azure subscription:
-
Iterate through each DNS zone and check for CName records:
- Save and run the Python script. It will delete all the CName records in your Azure DNS zones.
subscription_id with your Azure subscription ID.Please ensure that you understand the impact of deleting CName records before executing the script. It is recommended to test the script in a non-production environment first.