Description:
By default, Azure Functions, Web, and API Services
can be deployed over FTP. If FTP is required for an
essential deployment workflow, FTPS should be required
for FTP login for all App Service Apps and Functions.
Rationale:
Azure FTP deployment endpoints are public. An attacker listening to traffic on a wifi network used by a remote employee or a corporate network could see login traffic in clear-text which would then grant them full control of the code base of the app or service. This finding is more severe if User Credentials for deployment are set at the subscription level rather than using the default Application Credentials which are unique per App.
Any deployment workflows that rely on FTP or FTPs rather than the WebDeploy or HTTPs endpoints may be affected.
From Azure Portal
From Azure CLI
For each out of compliance application, run the following choosing either 'disabled' or 'FtpsOnly' as appropriate:
az webapp config set --resource-group --name --ftps-state [disabled|FtpsOnly]
From PowerShell
For each out of compliance application, run the following:
Set-AzWebApp -ResourceGroupName -Name -FtpsState