feat(exchange): add new check exchange_mailbox_policy_additional_storage_restricted (#7638)

Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com>

prowler/CHANGELOG.md

@@ -37,6 +37,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Add new check `teams_meeting_chat_anonymous_users_disabled` [(#7579)](https://github.com/prowler-cloud/prowler/pull/7579)
 - Add Prowler Threat Score Compliance Framework [(#7603)](https://github.com/prowler-cloud/prowler/pull/7603)
 - Add new check `sharepoint_onedrive_sync_restricted_unmanaged_devices` [(#7589)](https://github.com/prowler-cloud/prowler/pull/7589)
+- Add new check for Additional Storage restricted for Exchange in M365 [(#7638)](https://github.com/prowler-cloud/prowler/pull/7638)
 
 ### Fixed
 

prowler/providers/m365/lib/powershell/m365_powershell.py

@@ -466,3 +466,21 @@ class M365PowerShell(PowerShellSession):
         return self.execute(
             "Get-HostedContentFilterPolicy | ConvertTo-Json", json_parse=True
         )
+
+    def get_mailbox_policy(self) -> dict:
+        """
+        Get Mailbox Policy.
+
+        Retrieves the current mailbox policy settings for Exchange Online.
+
+        Returns:
+            dict: Mailbox policy settings in JSON format.
+
+        Example:
+            >>> get_mailbox_policy()
+            {
+                "Id": "OwaMailboxPolicy-Default",
+                "AdditionalStorageProvidersAvailable": True
+            }
+        """
+        return self.execute("Get-OwaMailboxPolicy | ConvertTo-Json", json_parse=True)

prowler/providers/m365/services/exchange/exchange_mailbox_policy_additional_storage_restricted/exchange_mailbox_policy_additional_storage_restricted.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "m365",
+  "CheckID": "exchange_mailbox_policy_additional_storage_restricted",
+  "CheckTitle": "Ensure additional storage providers are restricted in Outlook on the web.",
+  "CheckType": [],
+  "ServiceName": "exchange",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Exchange Mailboxes Policy",
+  "Description": "Restrict the availability of additional storage providers (e.g., Box, Dropbox, Google Drive) in Outlook on the web to prevent users from accessing external storage services through the OWA interface.",
+  "Risk": "Allowing users to access third-party storage providers from Outlook on the web increases the risk of data exfiltration and exposure to untrusted content or malware.",
+  "RelatedUrl": "https://learn.microsoft.com/en-us/powershell/module/exchange/set-owamailboxpolicy?view=exchange-ps",
+  "Remediation": {
+    "Code": {
+      "CLI": "Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -AdditionalStorageProvidersAvailable $false",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Disable access to additional storage providers in Outlook on the web to reduce the risk of data leakage.",
+      "Url": "https://learn.microsoft.com/en-us/powershell/module/exchange/set-owamailboxpolicy?view=exchange-ps"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/m365/services/exchange/exchange_mailbox_policy_additional_storage_restricted/exchange_mailbox_policy_additional_storage_restricted.py

@@ -0,0 +1,44 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportM365
+from prowler.providers.m365.services.exchange.exchange_client import exchange_client
+
+
+class exchange_mailbox_policy_additional_storage_restricted(Check):
+    """Check if Exchange mailbox policy restricts additional storage providers.
+
+    This check ensures that the mailbox policy does not allow additional storage providers.
+    """
+
+    def execute(self) -> List[CheckReportM365]:
+        """Run the check to validate Exchange mailbox policy restrictions.
+
+        Iterates through the mailbox policy configuration to determine if additional storage
+        providers are restricted and generates a report based on the policy status.
+
+        Returns:
+            List[CheckReportM365]: A list of reports with the restriction status for the mailbox policy.
+        """
+        findings = []
+        mailbox_policy = exchange_client.mailbox_policy
+        if mailbox_policy:
+            report = CheckReportM365(
+                metadata=self.metadata(),
+                resource=mailbox_policy,
+                resource_name="Exchange Mailbox Policy",
+                resource_id=mailbox_policy.id,
+            )
+            report.status = "FAIL"
+            report.status_extended = (
+                "Exchange mailbox policy allows additional storage providers."
+            )
+
+            if not mailbox_policy.additional_storage_enabled:
+                report.status = "PASS"
+                report.status_extended = (
+                    "Exchange mailbox policy restricts additional storage providers."
+                )
+
+            findings.append(report)
+
+        return findings

prowler/providers/m365/services/exchange/exchange_service.py

@@ -14,6 +14,7 @@ class Exchange(M365Service):
         self.mailboxes_config = []
         self.external_mail_config = []
         self.transport_rules = []
+        self.mailbox_policy = None
 
         if self.powershell:
             self.powershell.connect_exchange_online()
@@ -21,6 +22,7 @@ class Exchange(M365Service):
             self.mailboxes_config = self._get_mailbox_audit_config()
             self.external_mail_config = self._get_external_mail_config()
             self.transport_rules = self._get_transport_rules()
+            self.mailbox_policy = self._get_mailbox_policy()
             self.powershell.close()
 
     def _get_organization_config(self):
@@ -112,6 +114,24 @@ class Exchange(M365Service):
             )
         return transport_rules
 
+    def _get_mailbox_policy(self):
+        logger.info("Microsoft365 - Getting mailbox policy configuration...")
+        mailboxes_policy = None
+        try:
+            mailbox_policy = self.powershell.get_mailbox_policy()
+            if mailbox_policy:
+                mailboxes_policy = MailboxPolicy(
+                    id=mailbox_policy.get("Id", ""),
+                    additional_storage_enabled=mailbox_policy.get(
+                        "AdditionalStorageProvidersAvailable", True
+                    ),
+                )
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+        return mailboxes_policy
+
 
 class Organization(BaseModel):
     name: str
@@ -134,3 +154,8 @@ class TransportRule(BaseModel):
     name: str
     scl: Optional[int]
     sender_domain_is: list[str]
+
+
+class MailboxPolicy(BaseModel):
+    id: str
+    additional_storage_enabled: bool

tests/providers/m365/services/exchange/exchange_mailbox_policy_additional_storage_restricted/exchange_mailbox_policy_additional_storage_restricted_test.py

@@ -0,0 +1,118 @@
+from unittest import mock
+
+from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
+
+
+class Test_exchange_mailbox_policy_additional_storage_restricted:
+    def test_mailbox_policy_restricts_additional_storage(self):
+        exchange_client = mock.MagicMock()
+        exchange_client.audited_tenant = "audited_tenant"
+        exchange_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.exchange.exchange_mailbox_policy_additional_storage_restricted.exchange_mailbox_policy_additional_storage_restricted.exchange_client",
+                new=exchange_client,
+            ),
+        ):
+            from prowler.providers.m365.services.exchange.exchange_mailbox_policy_additional_storage_restricted.exchange_mailbox_policy_additional_storage_restricted import (
+                exchange_mailbox_policy_additional_storage_restricted,
+            )
+            from prowler.providers.m365.services.exchange.exchange_service import (
+                MailboxPolicy,
+            )
+
+            exchange_client.mailbox_policy = MailboxPolicy(
+                id="OwaMailboxPolicy-Default", additional_storage_enabled=False
+            )
+
+            check = exchange_mailbox_policy_additional_storage_restricted()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "Exchange mailbox policy restricts additional storage providers."
+            )
+            assert result[0].resource == exchange_client.mailbox_policy.dict()
+            assert result[0].resource_name == "Exchange Mailbox Policy"
+            assert result[0].resource_id == "OwaMailboxPolicy-Default"
+            assert result[0].location == "global"
+
+    def test_mailbox_policy_allows_additional_storage(self):
+        exchange_client = mock.MagicMock()
+        exchange_client.audited_tenant = "audited_tenant"
+        exchange_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.exchange.exchange_mailbox_policy_additional_storage_restricted.exchange_mailbox_policy_additional_storage_restricted.exchange_client",
+                new=exchange_client,
+            ),
+        ):
+            from prowler.providers.m365.services.exchange.exchange_mailbox_policy_additional_storage_restricted.exchange_mailbox_policy_additional_storage_restricted import (
+                exchange_mailbox_policy_additional_storage_restricted,
+            )
+            from prowler.providers.m365.services.exchange.exchange_service import (
+                MailboxPolicy,
+            )
+
+            exchange_client.mailbox_policy = MailboxPolicy(
+                id="OwaMailboxPolicy-Default", additional_storage_enabled=True
+            )
+
+            check = exchange_mailbox_policy_additional_storage_restricted()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "Exchange mailbox policy allows additional storage providers."
+            )
+            assert result[0].resource == exchange_client.mailbox_policy.dict()
+            assert result[0].resource_name == "Exchange Mailbox Policy"
+            assert result[0].resource_id == "OwaMailboxPolicy-Default"
+            assert result[0].location == "global"
+
+    def test_no_mailbox_policy(self):
+        exchange_client = mock.MagicMock()
+        exchange_client.audited_tenant = "audited_tenant"
+        exchange_client.audited_domain = DOMAIN
+        exchange_client.mailbox_policy = None
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.exchange.exchange_mailbox_policy_additional_storage_restricted.exchange_mailbox_policy_additional_storage_restricted.exchange_client",
+                new=exchange_client,
+            ),
+        ):
+            from prowler.providers.m365.services.exchange.exchange_mailbox_policy_additional_storage_restricted.exchange_mailbox_policy_additional_storage_restricted import (
+                exchange_mailbox_policy_additional_storage_restricted,
+            )
+
+            check = exchange_mailbox_policy_additional_storage_restricted()
+            result = check.execute()
+            assert len(result) == 0

tests/providers/m365/services/exchange/exchange_service_test.py

@@ -6,6 +6,7 @@ from prowler.providers.m365.services.exchange.exchange_service import (
     Exchange,
     ExternalMailConfig,
     MailboxAuditConfig,
+    MailboxPolicy,
     Organization,
     TransportRule,
 )
@@ -51,6 +52,13 @@ def mock_exchange_get_transport_rules(_):
     ]
 
 
+def mock_exchange_get_mailbox_policy(_):
+    return MailboxPolicy(
+        id="test",
+        additional_storage_enabled=True,
+    )
+
+
 class Test_Exchange_Service:
     def test_get_client(self):
         with (
@@ -163,3 +171,23 @@ class Test_Exchange_Service:
             assert transport_rules[1].sender_domain_is == ["example.com"]
 
             exchange_client.powershell.close()
+
+    @patch(
+        "prowler.providers.m365.services.exchange.exchange_service.Exchange._get_mailbox_policy",
+        new=mock_exchange_get_mailbox_policy,
+    )
+    def test_get_mailbox_policy(self):
+        with (
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+        ):
+            exchange_client = Exchange(
+                set_mocked_m365_provider(
+                    identity=M365IdentityInfo(tenant_domain=DOMAIN)
+                )
+            )
+            mailbox_policy = exchange_client.mailbox_policy
+            assert mailbox_policy.id == "test"
+            assert mailbox_policy.additional_storage_enabled is True
+            exchange_client.powershell.close()