Ensure That 'PHP version' is the Latest, If Used to Run the Web App

Risk Level: Low
Cloud Entity: Web Apps service
CloudGuard Rule ID: D9.AZU.CRY.40
Covered by Spectral: No
Category: Compute

GSL LOGIC

WebApp where config.phpVersion regexMatch /^(?!\s*$).+/ should have config.phpVersion='7.3'

REMEDIATION

From Portal

1. Login to Azure Portal using https://portal.azure.com.
2. Go to 'App Services'.
3. Click on each Windows WebApp.
4. Under 'Settings' section, click on 'Configuration'.
5. Click on the 'General settings' pane, ensure that for a Stack of PHP and a Major version of PHP 8, that the Minor version is set to the latest available stable release.
6. Click Save.

NOTE: No action is required If PHP version is set to Off as PHP is not used by your web app

From TF

Set the latest PHP version as below:

resource "azurerm_windows_web_app" "example" {
	..
	site_config {
		..
		application_stack{
			current_stack = "php"
			php_version = "Latest-PHP-Version"
		}
		..
	}
	..
}

From Command Line

To see the list of supported runtimes:

az webapp list-runtimes --os windows | grep PHP

To set latest PHP version for an existing app, run the following command:

az webapp config set --resource-group RESOURCEGROUP --name WEBAPP --php-version VERSION

References

1. https://docs.microsoft.com/en-us/azure/app-service/configure-language-php?pivots=platform-windows
2. https://docs.microsoft.com/en-us/azure/app-service/configure-common?tabs=portal
3. https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/windows_web_app#php_version

Web Apps service

Azure App Service is an HTTP-based service for hosting web applications, REST APIs, and mobile back ends. You can develop in your favorite language, be it .NET, .NET Core, Java, Ruby, Node.js, PHP, or Python. Applications run and scale with ease on both Windows and Linux-based environments.

Compliance Frameworks

• Azure CIS Foundations v. 1.2.0
• Azure CIS Foundations v. 1.3.0
• Azure CIS Foundations v. 1.3.1
• Azure CIS Foundations v. 1.4.0
• Azure CIS Foundations v. 1.5.0
• Azure CIS Foundations v.2.0
• Azure CloudGuard Best Practices
• Azure NIST 800-53 Rev 5
• CloudGuard Azure All Rules Ruleset