| name | cis-azure-compute-2.4.4 |
| description | Ensure 'FTP state' is set to 'FTPS only' or 'Disabled' |
| category | cis-azure-compute |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","functions","deployment-slots"] |
| cis_id | 2.4.4 |
| cis_benchmark | CIS Microsoft Azure Compute Services Benchmark v2.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Ensure 'FTP state' is set to 'FTPS only' or 'Disabled'
Description
By default, App Service supports deployment over FTP. If FTP is essential for a deployment workflow, FTPS should be enforced for all function app deployment slots.
If FTPS is not explicitly required, the recommended setting is Disabled.
Rationale
FTP is an unencrypted network protocol that transmits data -- including passwords -- in clear text. The use of this protocol can lead to both data and credential compromise and can present opportunities for exfiltration, persistence, and lateral movement.
Impact
Deployment workflows that rely on FTP or FTPS rather than WebDeploy or HTTPS endpoints may be affected.
Audit Procedure
Using Azure Portal
- Go to
App Services or Function App.
- Click the name of a function app.
- Under
Deployment, click Deployment Slots.
- Click the name of a deployment slot.
- Under
Settings, click Configuration.
- In the
General settings pane, under Platform settings, ensure that FTP state is set to FTPS only or Disabled.
- Repeat steps 1-6 for each function app and deployment slot.
Using Azure CLI
Run the following command to list function apps:
az functionapp list
For each function app, run the following command to list deployment slots:
az functionapp deployment slot list --resource-group <resource-group-name> --name <function-app-name>
For each deployment slot, run the following command to get the FTPS state setting:
az resource show --name web --resource-group <resource-group-name> --namespace Microsoft.Web --resource-type config --parent sites/<function-app-name>/slots/<deployment-slot-name> --query properties.ftpsState
Ensure that "FtpsOnly" or "Disabled" is returned.
Expected Result
The ftpsState property should return "FtpsOnly" or "Disabled".
Remediation
Using Azure Portal
- Go to
App Services or .
