Ensure That 'PHP version' is the Latest, If Used to Run the Linux Web App

Risk Level: Low
Cloud Entity: Web Apps service
CloudGuard Rule ID: D9.AZU.CRY.44
Covered by Spectral: No
Category: Compute

GSL LOGIC

WebApp where config.linuxFxVersion regexMatch /PHP*/ should have config.linuxFxVersion regexMatch /PHP|[7.0-8.0]/

REMEDIATION

From Portal

1. Login to Azure Portal using https://portal.azure.com.
2. Go to 'App Services'.
3. Click on each linux WebApp.
4. Under 'Settings' section, click on 'Configuration'.
5. Click on the 'General settings' pane, ensure that for a Stack of PHP and a Major version of PHP 8, that the Minor version is set to the latest available stable release.
6. Click Save.

NOTE: NOTE: No action is required If Java version is set to Off as Java is not used by your web app.

From TF

Set the latest PHP version as below:

resource "azurerm_linux_web_app" "example" {
	..
	site_config {
		..
		application_stack{
			php_version = "Latest-PHP-Version"
		}
		..
	}
	..
}

From Command Line

To see the list of supported runtimes:

az webapp list-runtimes --os linux | grep PHP

To set latest PHP version for an existing app, run the following command:

az webapp config set --resource-group RESOURCEGROUP --name WEBAPP --linux-fx-version PHP|VERSION

References

1. https://docs.microsoft.com/en-us/azure/app-service/configure-language-php?pivots=platform-linux
2. https://docs.microsoft.com/en-us/azure/app-service/configure-common?tabs=portal
3. https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_web_app#php_version

Web Apps service

Azure App Service is an HTTP-based service for hosting web applications, REST APIs, and mobile back ends. You can develop in your favorite language, be it .NET, .NET Core, Java, Ruby, Node.js, PHP, or Python. Applications run and scale with ease on both Windows and Linux-based environments.

Compliance Frameworks

• Azure CIS Foundations v. 1.2.0
• Azure CIS Foundations v. 1.3.0
• Azure CIS Foundations v. 1.3.1
• Azure CIS Foundations v. 1.4.0
• Azure CIS Foundations v. 1.5.0
• Azure CloudGuard Best Practices
• CloudGuard Azure All Rules Ruleset