cloud-report
Version:
Collects and analyzes cloud resources
58 lines (57 loc) • 2.79 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
const types_1 = require("../../../types");
const base_1 = require("../../base");
class MSSQLPortOpenToWorldAnalyzer extends base_1.BaseAnalyzer {
analyze(params, fullReport) {
const allSecurityGroups = params.security_groups;
if (!allSecurityGroups) {
return undefined;
}
const mssql_db_port_open_to_world = { type: types_1.CheckAnalysisType.Security };
mssql_db_port_open_to_world.what = "Is MSSQL port open to world?";
mssql_db_port_open_to_world.why = "We should always restrict MSSQL port only intended parties to access";
mssql_db_port_open_to_world.recommendation = `Recommended to restrict MSSQL
port in security groups to specific IPs`;
mssql_db_port_open_to_world.benchmark = ['all', 'hipaa'];
const allRegionsAnalysis = {};
for (const region in allSecurityGroups) {
const regionSecurityGroups = allSecurityGroups[region];
allRegionsAnalysis[region] = [];
for (const securityGroup of regionSecurityGroups) {
if (securityGroup.GroupName === "default") {
continue;
}
const securityGroupAnalysis = {};
securityGroupAnalysis.resource = securityGroup;
securityGroupAnalysis.resourceSummary = {
name: "SecurityGroup",
value: `${securityGroup.GroupName} | ${securityGroup.GroupId}`,
};
if (this.isMSSQLOpenToWorld(securityGroup)) {
securityGroupAnalysis.severity = types_1.SeverityStatus.Failure;
securityGroupAnalysis.message = "MSSQL Port is open to entire world";
securityGroupAnalysis.action = "Restrict MSSQL port";
}
else {
securityGroupAnalysis.severity = types_1.SeverityStatus.Good;
securityGroupAnalysis.message = "MSSQL port is not open to entire world";
}
allRegionsAnalysis[region].push(securityGroupAnalysis);
}
}
mssql_db_port_open_to_world.regions = allRegionsAnalysis;
return { mssql_db_port_open_to_world };
}
isMSSQLOpenToWorld(securityGroup) {
if (!securityGroup) {
return false;
}
return securityGroup.IpPermissions.some((rule) => {
return rule.FromPort === 1433 && rule.IpRanges.some((ipRange) => {
return ipRange.CidrIp === "0.0.0.0/0";
});
});
}
}
exports.MSSQLPortOpenToWorldAnalyzer = MSSQLPortOpenToWorldAnalyzer;