​
More Info:

Ensure Azure Subdomain NS Records are not vulnerable

​
Risk Level

Medium

​
Address

Security

​
Compliance Standards

CBP

​
Triage and Remediation

​
Remediation

Using Console

To remediate the Azure Subdomain NS Records vulnerability in the Azure Network using the Azure console, follow these steps:
  1. Log in to the Azure portal (portal.azure.com) using your Azure account credentials.
  2. Navigate to the Azure DNS service by searching for “DNS” in the search bar at the top of the portal and selecting “DNS zones” from the results.
  3. In the DNS zones blade, select the DNS zone that contains the vulnerable subdomain NS records.
  4. Once you’ve selected the DNS zone, you will see a list of DNS records associated with it. Look for the NS records related to the vulnerable subdomain.
  5. Select the vulnerable NS record to open the record details.
  6. In the record details, click on the “Edit” button to modify the NS record.
  7. Replace the existing vulnerable NS record with the correct NS record provided by your DNS provider or the authoritative DNS server for the subdomain.
  8. Save the changes by clicking on the “Save” button.
  9. Repeat steps 5 to 8 for all the vulnerable NS records associated with the subdomain.
  10. Once you have updated all the NS records, monitor the DNS propagation to ensure the changes are reflected across the DNS infrastructure. This may take some time depending on the TTL (Time to Live) settings of the DNS records.
  11. After the DNS changes have propagated, verify the subdomain NS records using DNS lookup tools or commands to ensure they are pointing to the correct authoritative DNS servers.
By following these steps, you will be able to remediate the Azure Subdomain NS Records vulnerability in the Azure Network using the Azure console.

​

To remediate the Azure Subdomain NS Records vulnerability using Azure CLI, follow these step-by-step instructions:
  1. Install and configure Azure CLI: If you haven’t already, install Azure CLI on your local machine and sign in to your Azure account using the command az login.
  2. Identify the affected subdomain: Determine the subdomain that has the vulnerable NS records.
  3. Retrieve the current NS records: Use the following command to retrieve the current NS records for the subdomain: 
    az network dns zone show --name <zone_name> --resource-group <resource_group_name>
    Replace <zone_name> with the name of the DNS zone containing the subdomain and <resource_group_name> with the name of the resource group where the DNS zone is located.
  4. Update the NS records: Remove the vulnerable NS records and add the correct ones using the following command: 
    az network dns record-set ns update --name <record_set_name> --zone-name <zone_name> --resource-group <resource_group_name> --remove nsRecords --add nsRecords <new_ns_records>
    Replace <record_set_name> with the name of the record set containing the NS records, <zone_name> with the name of the DNS zone, <resource_group_name> with the resource group name, and <new_ns_records> with the correct NS records. Note: Ensure that you remove the vulnerable NS records and add the correct ones in the --remove and --add parameters, respectively.
  5. Verify the changes: Use the following command to verify that the NS records have been updated: 
    az network dns record-set ns show --name <record_set_name> --zone-name <zone_name> --resource-group <resource_group_name>
    Ensure that the output reflects the updated NS records.
By following these steps, you can remediate the Azure Subdomain NS Records vulnerability using Azure CLI.
To remediate the Azure subdomain NS records vulnerability using Python, you can follow these steps:
  1. Install the required Python packages: 
    pip install azure-mgmt-dns
  2. Import the necessary modules in your Python script: 
    from azure.identity import DefaultAzureCredential
from azure.mgmt.dns import DnsManagementClient
  3. Authenticate with Azure using the DefaultAzureCredential: 
    credential = DefaultAzureCredential()
dns_client = DnsManagementClient(credential, subscription_id)
  4. Retrieve the list of DNS zones in your Azure subscription: 
    zones = dns_client.zones.list()
  5. Iterate through each DNS zone and check for subdomains with vulnerable NS records: 
    for zone in zones:
    record_sets = dns_client.record_sets.list_by_dns_zone(zone.resource_group, zone.name)
    for record_set in record_sets:
        if record_set.type == 'NS' and record_set.ttl < 3600:
            # Update the TTL value for vulnerable NS records
            record_set.ttl = 3600
            dns_client.record_sets.update(zone.resource_group, zone.name, record_set.name, record_set.type, record_set)
  6. Save the Python script and execute it. Ensure that you have the necessary permissions to modify DNS records in your Azure subscription.
This script will iterate through all the DNS zones in your Azure subscription and identify any NS records with a TTL (Time to Live) value less than 3600 seconds (1 hour). It will then update the TTL value for these vulnerable NS records to 3600 seconds, which is the recommended minimum value.Make sure to replace subscription_id with your Azure subscription ID in the authentication step.Note: This script assumes that you have already authenticated with Azure and have the necessary permissions to modify DNS records.