Microsoft Defender reports High attack paths for Azure TRE Guacamole Web Apps

[Ansar Rafique (ansarrafique)]

We are running Azure TRE v0.27.0 and use Microsoft Defender for Cloud to monitor the environment. Defender is currently reporting three High-severity attack paths for the Guacamole Web Apps:

Internet exposed Azure Web App with high severity vulnerabilities

The attack path is:

Internet → Guacamole Web App

Defender reports high-severity vulnerabilities in the internet-facing Guacamole Web Apps.

I understand that Guacamole is expected to be internet-facing, but I would like to understand how concerning these vulnerabilities are.

Specifically, I would appreciate it if you could please provide some guidance on the following:

1. Am I understanding this finding correctly, and is this something I should be concerned about?
2. Are these known findings for the Guacamole deployment in Azure TRE v0.27.0?
3. Have they been addressed in a newer Azure TRE release, or are there plans to address them in a future release?
4. Should these be addressed upstream in Azure TRE, or are individual deployments expected to address them?
5. If they need to be addressed locally, what is the recommended approach?

I would prefer to follow the upstream Azure TRE approach rather than maintain local changes if possible.

[Daniel Zabinski (DanZab)]

Hi Ansar,

We are running v0.28.0 and our Defender for Cloud is not listing anything other than low severity component upgrades for guacamole. Are you able to upgrade your TRE version and the guacamole service to see if that resolves the issue?

[Ansar Rafique (ansarrafique)]

Hi Daniel,

Thank you for the insight. Good to know v0.28.0 clears those up. We are now planning to upgrade our deployment to v0.28.0 soon. Once done, I will post an update here with the new Defender findings.