diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 1c7cbc4175..09184ad5c4 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -37,6 +37,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Add new check `teams_meeting_chat_anonymous_users_disabled` [(#7579)](https://github.com/prowler-cloud/prowler/pull/7579) - Add Prowler Threat Score Compliance Framework [(#7603)](https://github.com/prowler-cloud/prowler/pull/7603) - Add new check `sharepoint_onedrive_sync_restricted_unmanaged_devices` [(#7589)](https://github.com/prowler-cloud/prowler/pull/7589) +- Add new check for Additional Storage restricted for Exchange in M365 [(#7638)](https://github.com/prowler-cloud/prowler/pull/7638) ### Fixed diff --git a/prowler/providers/m365/lib/powershell/m365_powershell.py b/prowler/providers/m365/lib/powershell/m365_powershell.py index 982e26672b..91974a0b15 100644 --- a/prowler/providers/m365/lib/powershell/m365_powershell.py +++ b/prowler/providers/m365/lib/powershell/m365_powershell.py @@ -466,3 +466,21 @@ class M365PowerShell(PowerShellSession): return self.execute( "Get-HostedContentFilterPolicy | ConvertTo-Json", json_parse=True ) + + def get_mailbox_policy(self) -> dict: + """ + Get Mailbox Policy. + + Retrieves the current mailbox policy settings for Exchange Online. + + Returns: + dict: Mailbox policy settings in JSON format. + + Example: + >>> get_mailbox_policy() + { + "Id": "OwaMailboxPolicy-Default", + "AdditionalStorageProvidersAvailable": True + } + """ + return self.execute("Get-OwaMailboxPolicy | ConvertTo-Json", json_parse=True) diff --git a/prowler/providers/m365/services/exchange/exchange_mailbox_policy_additional_storage_restricted/__init__.py b/prowler/providers/m365/services/exchange/exchange_mailbox_policy_additional_storage_restricted/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/m365/services/exchange/exchange_mailbox_policy_additional_storage_restricted/exchange_mailbox_policy_additional_storage_restricted.metadata.json b/prowler/providers/m365/services/exchange/exchange_mailbox_policy_additional_storage_restricted/exchange_mailbox_policy_additional_storage_restricted.metadata.json new file mode 100644 index 0000000000..1657d50dbd --- /dev/null +++ b/prowler/providers/m365/services/exchange/exchange_mailbox_policy_additional_storage_restricted/exchange_mailbox_policy_additional_storage_restricted.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "m365", + "CheckID": "exchange_mailbox_policy_additional_storage_restricted", + "CheckTitle": "Ensure additional storage providers are restricted in Outlook on the web.", + "CheckType": [], + "ServiceName": "exchange", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "Exchange Mailboxes Policy", + "Description": "Restrict the availability of additional storage providers (e.g., Box, Dropbox, Google Drive) in Outlook on the web to prevent users from accessing external storage services through the OWA interface.", + "Risk": "Allowing users to access third-party storage providers from Outlook on the web increases the risk of data exfiltration and exposure to untrusted content or malware.", + "RelatedUrl": "https://learn.microsoft.com/en-us/powershell/module/exchange/set-owamailboxpolicy?view=exchange-ps", + "Remediation": { + "Code": { + "CLI": "Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -AdditionalStorageProvidersAvailable $false", + "NativeIaC": "", + "Other": "", + "Terraform": "" + }, + "Recommendation": { + "Text": "Disable access to additional storage providers in Outlook on the web to reduce the risk of data leakage.", + "Url": "https://learn.microsoft.com/en-us/powershell/module/exchange/set-owamailboxpolicy?view=exchange-ps" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} diff --git a/prowler/providers/m365/services/exchange/exchange_mailbox_policy_additional_storage_restricted/exchange_mailbox_policy_additional_storage_restricted.py b/prowler/providers/m365/services/exchange/exchange_mailbox_policy_additional_storage_restricted/exchange_mailbox_policy_additional_storage_restricted.py new file mode 100644 index 0000000000..05ecd7cc0d --- /dev/null +++ b/prowler/providers/m365/services/exchange/exchange_mailbox_policy_additional_storage_restricted/exchange_mailbox_policy_additional_storage_restricted.py @@ -0,0 +1,44 @@ +from typing import List + +from prowler.lib.check.models import Check, CheckReportM365 +from prowler.providers.m365.services.exchange.exchange_client import exchange_client + + +class exchange_mailbox_policy_additional_storage_restricted(Check): + """Check if Exchange mailbox policy restricts additional storage providers. + + This check ensures that the mailbox policy does not allow additional storage providers. + """ + + def execute(self) -> List[CheckReportM365]: + """Run the check to validate Exchange mailbox policy restrictions. + + Iterates through the mailbox policy configuration to determine if additional storage + providers are restricted and generates a report based on the policy status. + + Returns: + List[CheckReportM365]: A list of reports with the restriction status for the mailbox policy. + """ + findings = [] + mailbox_policy = exchange_client.mailbox_policy + if mailbox_policy: + report = CheckReportM365( + metadata=self.metadata(), + resource=mailbox_policy, + resource_name="Exchange Mailbox Policy", + resource_id=mailbox_policy.id, + ) + report.status = "FAIL" + report.status_extended = ( + "Exchange mailbox policy allows additional storage providers." + ) + + if not mailbox_policy.additional_storage_enabled: + report.status = "PASS" + report.status_extended = ( + "Exchange mailbox policy restricts additional storage providers." + ) + + findings.append(report) + + return findings diff --git a/prowler/providers/m365/services/exchange/exchange_service.py b/prowler/providers/m365/services/exchange/exchange_service.py index 5bd8cada6a..dbcc44499f 100644 --- a/prowler/providers/m365/services/exchange/exchange_service.py +++ b/prowler/providers/m365/services/exchange/exchange_service.py @@ -14,6 +14,7 @@ class Exchange(M365Service): self.mailboxes_config = [] self.external_mail_config = [] self.transport_rules = [] + self.mailbox_policy = None if self.powershell: self.powershell.connect_exchange_online() @@ -21,6 +22,7 @@ class Exchange(M365Service): self.mailboxes_config = self._get_mailbox_audit_config() self.external_mail_config = self._get_external_mail_config() self.transport_rules = self._get_transport_rules() + self.mailbox_policy = self._get_mailbox_policy() self.powershell.close() def _get_organization_config(self): @@ -112,6 +114,24 @@ class Exchange(M365Service): ) return transport_rules + def _get_mailbox_policy(self): + logger.info("Microsoft365 - Getting mailbox policy configuration...") + mailboxes_policy = None + try: + mailbox_policy = self.powershell.get_mailbox_policy() + if mailbox_policy: + mailboxes_policy = MailboxPolicy( + id=mailbox_policy.get("Id", ""), + additional_storage_enabled=mailbox_policy.get( + "AdditionalStorageProvidersAvailable", True + ), + ) + except Exception as error: + logger.error( + f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return mailboxes_policy + class Organization(BaseModel): name: str @@ -134,3 +154,8 @@ class TransportRule(BaseModel): name: str scl: Optional[int] sender_domain_is: list[str] + + +class MailboxPolicy(BaseModel): + id: str + additional_storage_enabled: bool diff --git a/tests/providers/m365/services/exchange/exchange_mailbox_policy_additional_storage_restricted/exchange_mailbox_policy_additional_storage_restricted_test.py b/tests/providers/m365/services/exchange/exchange_mailbox_policy_additional_storage_restricted/exchange_mailbox_policy_additional_storage_restricted_test.py new file mode 100644 index 0000000000..688d68add6 --- /dev/null +++ b/tests/providers/m365/services/exchange/exchange_mailbox_policy_additional_storage_restricted/exchange_mailbox_policy_additional_storage_restricted_test.py @@ -0,0 +1,118 @@ +from unittest import mock + +from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider + + +class Test_exchange_mailbox_policy_additional_storage_restricted: + def test_mailbox_policy_restricts_additional_storage(self): + exchange_client = mock.MagicMock() + exchange_client.audited_tenant = "audited_tenant" + exchange_client.audited_domain = DOMAIN + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_m365_provider(), + ), + mock.patch( + "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online" + ), + mock.patch( + "prowler.providers.m365.services.exchange.exchange_mailbox_policy_additional_storage_restricted.exchange_mailbox_policy_additional_storage_restricted.exchange_client", + new=exchange_client, + ), + ): + from prowler.providers.m365.services.exchange.exchange_mailbox_policy_additional_storage_restricted.exchange_mailbox_policy_additional_storage_restricted import ( + exchange_mailbox_policy_additional_storage_restricted, + ) + from prowler.providers.m365.services.exchange.exchange_service import ( + MailboxPolicy, + ) + + exchange_client.mailbox_policy = MailboxPolicy( + id="OwaMailboxPolicy-Default", additional_storage_enabled=False + ) + + check = exchange_mailbox_policy_additional_storage_restricted() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == "Exchange mailbox policy restricts additional storage providers." + ) + assert result[0].resource == exchange_client.mailbox_policy.dict() + assert result[0].resource_name == "Exchange Mailbox Policy" + assert result[0].resource_id == "OwaMailboxPolicy-Default" + assert result[0].location == "global" + + def test_mailbox_policy_allows_additional_storage(self): + exchange_client = mock.MagicMock() + exchange_client.audited_tenant = "audited_tenant" + exchange_client.audited_domain = DOMAIN + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_m365_provider(), + ), + mock.patch( + "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online" + ), + mock.patch( + "prowler.providers.m365.services.exchange.exchange_mailbox_policy_additional_storage_restricted.exchange_mailbox_policy_additional_storage_restricted.exchange_client", + new=exchange_client, + ), + ): + from prowler.providers.m365.services.exchange.exchange_mailbox_policy_additional_storage_restricted.exchange_mailbox_policy_additional_storage_restricted import ( + exchange_mailbox_policy_additional_storage_restricted, + ) + from prowler.providers.m365.services.exchange.exchange_service import ( + MailboxPolicy, + ) + + exchange_client.mailbox_policy = MailboxPolicy( + id="OwaMailboxPolicy-Default", additional_storage_enabled=True + ) + + check = exchange_mailbox_policy_additional_storage_restricted() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == "Exchange mailbox policy allows additional storage providers." + ) + assert result[0].resource == exchange_client.mailbox_policy.dict() + assert result[0].resource_name == "Exchange Mailbox Policy" + assert result[0].resource_id == "OwaMailboxPolicy-Default" + assert result[0].location == "global" + + def test_no_mailbox_policy(self): + exchange_client = mock.MagicMock() + exchange_client.audited_tenant = "audited_tenant" + exchange_client.audited_domain = DOMAIN + exchange_client.mailbox_policy = None + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_m365_provider(), + ), + mock.patch( + "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online" + ), + mock.patch( + "prowler.providers.m365.services.exchange.exchange_mailbox_policy_additional_storage_restricted.exchange_mailbox_policy_additional_storage_restricted.exchange_client", + new=exchange_client, + ), + ): + from prowler.providers.m365.services.exchange.exchange_mailbox_policy_additional_storage_restricted.exchange_mailbox_policy_additional_storage_restricted import ( + exchange_mailbox_policy_additional_storage_restricted, + ) + + check = exchange_mailbox_policy_additional_storage_restricted() + result = check.execute() + assert len(result) == 0 diff --git a/tests/providers/m365/services/exchange/exchange_service_test.py b/tests/providers/m365/services/exchange/exchange_service_test.py index 8131157265..42cc16a507 100644 --- a/tests/providers/m365/services/exchange/exchange_service_test.py +++ b/tests/providers/m365/services/exchange/exchange_service_test.py @@ -6,6 +6,7 @@ from prowler.providers.m365.services.exchange.exchange_service import ( Exchange, ExternalMailConfig, MailboxAuditConfig, + MailboxPolicy, Organization, TransportRule, ) @@ -51,6 +52,13 @@ def mock_exchange_get_transport_rules(_): ] +def mock_exchange_get_mailbox_policy(_): + return MailboxPolicy( + id="test", + additional_storage_enabled=True, + ) + + class Test_Exchange_Service: def test_get_client(self): with ( @@ -163,3 +171,23 @@ class Test_Exchange_Service: assert transport_rules[1].sender_domain_is == ["example.com"] exchange_client.powershell.close() + + @patch( + "prowler.providers.m365.services.exchange.exchange_service.Exchange._get_mailbox_policy", + new=mock_exchange_get_mailbox_policy, + ) + def test_get_mailbox_policy(self): + with ( + mock.patch( + "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online" + ), + ): + exchange_client = Exchange( + set_mocked_m365_provider( + identity=M365IdentityInfo(tenant_domain=DOMAIN) + ) + ) + mailbox_policy = exchange_client.mailbox_policy + assert mailbox_policy.id == "test" + assert mailbox_policy.additional_storage_enabled is True + exchange_client.powershell.close()