(Organization) Disallow extensions from accessing resources on the local network
AZDO.1038MediumAzure DevOpsSecurity policiesPreview 3.0
Part of Maester · Azure DevOps · Security policies · All checks
Invoke-Maester -TestId AZDO.1038Overview
Section titled “Overview”Extensions should not be allowed to access resources on the local network.
Rationale: Allowing extensions to make requests to local network resources (loopback addresses like 127.0.0.1 or private IP ranges) increases the risk of server-side request forgery (SSRF) attacks. This policy should be disabled unless your extensions specifically require local network access.
Remediation action
Section titled “Remediation action”Disable the policy to prevent extensions from accessing local network resources.
- Sign in to your organization.
- Choose Organization settings.
- Select Policies, locate the “Allow extensions to access resources on the local network” policy and toggle it to off.
Results: With the policy disabled, extensions cannot make requests to loopback addresses or private IP address ranges, reducing the risk of SSRF attacks.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AZDO.1038 |
| Severity | Medium |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Security policies |
| Area | Applications and workload identities |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1190 Exploit Public-Facing Application |
| PowerShell test | Test-MtCheckAZDO1038 |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/marketplace/allow-extensions-local-network?view=azure-devops |