ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-23 04:21:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security-groups): remove RFC1918 from ec2_securitygroup_allow_wide_open_public_ipv4 (#4953)

Browse Source 
Co-authored-by: Pedro Martín <pedromarting3@gmail.com>
This commit is contained in:
Prowler Bot
2024-09-06 14:50:37 +02:00
committed by GitHub
parent 3c3ce82eb6
commit d71f8fc701
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/aws/services/ec2/ec2_securitygroup_allow_wide_open_public_ipv4/ec2_securitygroup_allow_wide_open_public_ipv4.metadata.json
+2 -2
View File
@@ -1,7 +1,7 @@
{
"Provider": "aws",
"CheckID": "ec2_securitygroup_allow_wide_open_public_ipv4",
"CheckTitle": "Ensure no security groups allow ingress and egress from wide-open non-RFC1918 address.",
"CheckTitle": "Ensure no security groups allow ingress and egress from wide-open IP address with a mask between 0 and 24.",
"CheckType": [
"Infrastructure Security"
],
@@ -10,7 +10,7 @@
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
"Severity": "high",
"ResourceType": "AwsEc2SecurityGroup",
"Description": "Ensure no security groups allow ingress and egress from wide-open non-RFC1918 address.",
"Description": "Ensure no security groups allow ingress and egress from ide-open IP address with a mask between 0 and 24.",
"Risk": "If Security groups are not properly configured the attack surface is increased.",
"RelatedUrl": "",
"Remediation": {
prowler/providers/aws/services/ec2/ec2_securitygroup_allow_wide_open_public_ipv4/ec2_securitygroup_allow_wide_open_public_ipv4.py
+2 -2
View File
@@ -28,7 +28,7 @@ class ec2_securitygroup_allow_wide_open_public_ipv4(Check):
for ingress_rule in security_group.ingress_rules:
for ipv4 in ingress_rule["IpRanges"]:
ip = ipaddress.ip_network(ipv4["CidrIp"])
# Check if IP is public according to RFC1918 and if 0 < prefixlen < 24
# Check if IP is public if 0 < prefixlen < 24
if (
ip.is_global
and ip.prefixlen < cidr_treshold
@@ -42,7 +42,7 @@ class ec2_securitygroup_allow_wide_open_public_ipv4(Check):
for egress_rule in security_group.egress_rules:
for ipv4 in egress_rule["IpRanges"]:
ip = ipaddress.ip_network(ipv4["CidrIp"])
# Check if IP is public according to RFC1918 and if 0 < prefixlen < 24
# Check if IP is public if 0 < prefixlen < 24
if (
ip.is_global
and ip.prefixlen < cidr_treshold