Back to Checks
azure

App Service web app uses the latest supported PHP version or 8.2 by default

app_ensure_php_version_is_latest
Service: appSeverity: low
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:microsoft.web/sites

Azure App Service web apps running PHP are evaluated to ensure the runtime is configured to the latest supported release. The finding compares the app's PHP stack (from linuxFxVersion or php_version) with the newest available version.

Prowler logoProwlerprowler-provider-azure

Risk

Using outdated PHP enables exploitation of known flaws, including remote code execution, causing secret disclosure (confidentiality), unauthorized changes (integrity), and crashes or downtime (availability). Deprecated versions lack patches, widening exposure and instability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks app_ensure_php_version_is_latest

Recommendation

Standardize on the latest supported PHP and avoid EoL releases. Update promptly after security advisories, validate in staging, and automate version governance across apps. Prefer supported Linux runtimes, limit optional extensions, and apply defense in depth and least privilege to reduce blast radius.

Remediation

CLI

az webapp config set --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --linux-fx-version "PHP|8.2"

Terraform

# Set latest PHP version on Linux Web App
resource "azurerm_linux_web_app" "app" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<example_location>"
  service_plan_id     = "<example_resource_id>"

  site_config {
    application_stack {
      php_version = "8.2" # Critical: sets PHP to latest to pass the check
    }
  }
}

NativeIaC

// Update App Service runtime to latest PHP
resource appConfig 'Microsoft.Web/sites/config@2022-09-01' = {
  name: '<example_resource_name>/web'
  properties: {
    linuxFxVersion: 'PHP|8.2' // Critical: sets the app runtime to PHP 8.2 (latest) to pass the check
  }
}

Other

1In Azure Portal, go to App Services and select your app
2Navigate to Settings > Configuration > General settings
3Under Stack settings, select PHP and set Version to 8.2
4Click Save and confirm the restart

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.app.app_client import app_client


class app_ensure_php_version_is_latest(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            apps,
        ) in app_client.apps.items():
            subscription_name = app_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for app in apps.values():
                framework = getattr(app.configurations, "linux_fx_version", "")

                if "php" in framework.lower() or getattr(
                    app.configurations, "php_version", ""
                ):
                    report = Check_Report_Azure(metadata=self.metadata(), resource=app)
                    report.subscription = subscription_id
                    report.status = "FAIL"

                    php_latest_version = app_client.audit_config.get(
                        "php_latest_version", "8.2"
                    )

                    report.status_extended = f"PHP version is set to '{framework}', the latest version that you could use is the '{php_latest_version}' version, for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."

                    if (
                        php_latest_version in framework
                        or getattr(app.configurations, "php_version", None)
                        == php_latest_version
                    ):
                        report.status = "PASS"
                        report.status_extended = f"PHP version is set to '{php_latest_version}' for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."

                    findings.append(report)

        return findings

References