AZDO.1038 - (Organization) Disallow extensions from accessing resources on the local network.
Overview
Extensions should not be allowed to access resources on the local network.
Rationale: Allowing extensions to make requests to local network resources (loopback addresses like 127.0.0.1 or private IP ranges) increases the risk of server-side request forgery (SSRF) attacks. This policy should be disabled unless your extensions specifically require local network access.
Remediation action
Disable the policy to prevent extensions from accessing local network resources.
- Sign in to your organization.
- Choose Organization settings.
- Select Policies, locate the "Allow extensions to access resources on the local network" policy and toggle it to off.
Results: With the policy disabled, extensions cannot make requests to loopback addresses or private IP address ranges, reducing the risk of SSRF attacks.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | AZDO.1038 |
| Severity | Medium |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Security policies |
| Area | Applications and workload identities |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1190 Exploit Public-Facing Application |
| PowerShell test | Test-MtCheckAZDO1038 |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/marketplace/allow-extensions-local-network?view=azure-devops |