Back to Checks
azure

App Service web app uses the latest supported Java version or 17 by default

app_ensure_java_version_is_latest
Service: appSeverity: low
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:microsoft.web/sites

Azure App Service web apps that run Java are assessed to ensure their configured runtime uses the latest supported major version (LTS) for the environment, across Linux and Windows.

Only apps with Java enabled are considered.

Prowler logoProwlerprowler-provider-azure

Risk

Using an outdated Java runtime enables known exploits like remote code execution, unsafe deserialization, and cryptographic flaws, risking data theft and tampering (confidentiality, integrity) and outages or takeover (availability). Unsupported versions also delay critical security patches.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks app_ensure_java_version_is_latest

Recommendation

Adopt the latest supported LTS Java (java <latest LTS>) and standardize on that major line.

  • Enable automatic minor/patch updates
  • Validate upgrades in a staging environment before production
  • Retire deprecated runtimes and track vendor EOL

Apply change management and defense in depth to reduce exposure.

Remediation

CLI

az webapp config set --resource-group <RESOURCE_GROUP> --name <APP_NAME> --linux-fx-version "JAVA|17-java17"

Terraform

# Linux Web App configured to use Java 17
resource "azurerm_linux_web_app" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<example_resource_name>"
  service_plan_id     = "<example_resource_id>"

  site_config {
    application_stack {
      java_version = "17" # Critical: sets Java to 17 to pass the check
    }
  }
}

NativeIaC

// Set Java 17 for a Linux App Service
resource app 'Microsoft.Web/sites@2022-09-01' existing = {
  name: '<example_resource_name>'
}

resource appConfig 'Microsoft.Web/sites/config@2022-09-01' = {
  name: '${app.name}/web'
  properties: {
    linuxFxVersion: 'JAVA|17-java17' // Critical: ensures runtime includes 'java17' so the check passes
  }
}

Other

1In the Azure portal, go to App Services and open your web app
2Select Settings > Configuration > General settings
3For Linux apps: under Stack settings, choose Java and set Java version to 17 (or choose Tomcat/JBoss with Java version 17)
4For Windows apps: under Stack settings, set Java version to 17
5Click Save and restart if prompted

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.app.app_client import app_client


class app_ensure_java_version_is_latest(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            apps,
        ) in app_client.apps.items():
            subscription_name = app_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for app in apps.values():
                linux_framework = getattr(app.configurations, "linux_fx_version", "")
                windows_framework_version = getattr(
                    app.configurations, "java_version", None
                )

                if "java" in linux_framework.lower() or windows_framework_version:
                    report = Check_Report_Azure(metadata=self.metadata(), resource=app)
                    report.subscription = subscription_id
                    report.status = "FAIL"
                    java_latest_version = app_client.audit_config.get(
                        "java_latest_version", "17"
                    )
                    report.status_extended = f"Java version is set to '{f'java{windows_framework_version}' if windows_framework_version else linux_framework}', but should be set to 'java {java_latest_version}' for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."

                    if (
                        f"java{java_latest_version}" in linux_framework
                        or java_latest_version == windows_framework_version
                    ):
                        report.status = "PASS"
                        report.status_extended = f"Java version is set to 'java {java_latest_version}' for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."

                    findings.append(report)

        return findings

References