Back to Checks
azure

Function app uses the latest supported runtime version (~4)

app_function_latest_runtime_version
Service: appSeverity: medium
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:microsoft.web/sites

Azure Function apps are assessed for the runtime version set via FUNCTIONS_EXTENSION_VERSION. The finding identifies apps not configured to use the current supported major version ~4.

Prowler logoProwlerprowler-provider-azure

Risk

Outdated Functions runtimes erode CIA:

  • Confidentiality: known flaws enable unauthorized data access.
  • Integrity: RCE or binding bugs allow code tampering.
  • Availability: missing fixes cause crashes and scale faults.

End-of-support versions (e.g., 2.x/3.x) lack security patches, increasing exploitability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks app_function_latest_runtime_version

Recommendation

Standardize on supported runtime ~4 and align language/extension versions.

  • Enforce upgrades in CI/CD and use staging to validate before rollout.
  • Apply least privilege for app identities and secrets.
  • Prefer automated patching and periodic reviews to avoid drift; avoid downgrades or indefinite minor pinning.

Remediation

CLI

az functionapp config appsettings set --name <function_app_name> --resource-group <resource_group_name> --settings FUNCTIONS_EXTENSION_VERSION=~4

Terraform

# Minimal Function App with runtime set to v4 (~4) - use azurerm_linux_function_app or azurerm_windows_function_app
resource "azurerm_resource_group" "example" {
  name     = "<example_resource_name>"
  location = "eastus"
}

resource "azurerm_storage_account" "example" {
  name                     = "<example_resource_name>"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

resource "azurerm_service_plan" "example" {
  name                = "<example_resource_name>"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  os_type             = "Linux"
  sku_name            = "Y1"
}

resource "azurerm_linux_function_app" "example" {
  name                       = "<example_resource_name>"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_service_plan.example.id
  storage_account_name       = azurerm_storage_account.example.name
  storage_account_access_key = azurerm_storage_account.example.primary_access_key

  site_config {}

  app_settings = {
    FUNCTIONS_EXTENSION_VERSION = "~4" # Critical: ensures the Function App uses runtime ~4
  }
}

NativeIaC

// Set Azure Functions runtime to v4 for an existing Function App
resource functionApp 'Microsoft.Web/sites@2022-09-01' existing = {
  name: '<example_resource_name>'
}

resource appSettings 'Microsoft.Web/sites/config@2022-09-01' = {
  name: '${functionApp.name}/appsettings'
  properties: {
    FUNCTIONS_EXTENSION_VERSION: '~4' // Critical: ensures the Function App uses runtime ~4
  }
}

Other

1In the Azure portal, go to Function App <example_resource_name>
2Select Configuration > Application settings
3Add or edit the setting:
4- Name: FUNCTIONS_EXTENSION_VERSION
5- Value: ~4
6Click Save and confirm the restart
7Verify the setting shows FUNCTIONS_EXTENSION_VERSION = ~4

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.app.app_client import app_client


class app_function_latest_runtime_version(Check):
    def execute(self):
        findings = []

        for (
            subscription_id,
            functions,
        ) in app_client.functions.items():
            subscription_name = app_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for function in functions.values():
                if function.environment_variables is not None:
                    report = Check_Report_Azure(
                        metadata=self.metadata(), resource=function
                    )
                    report.subscription = subscription_id
                    report.status = "PASS"
                    report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) is using the latest runtime."

                    if (
                        function.environment_variables.get(
                            "FUNCTIONS_EXTENSION_VERSION", ""
                        )
                        != "~4"
                    ):
                        report.status = "FAIL"
                        report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) is not using the latest runtime. The current runtime is '{function.environment_variables.get('FUNCTIONS_EXTENSION_VERSION', '')}' and should be '~4'."

                    findings.append(report)

        return findings

References