cloud-report
Version:
Collects and analyzes cloud resources
58 lines (57 loc) • 2.79 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
const types_1 = require("../../../types");
const base_1 = require("../../base");
class MySQLPortOpenToWorldAnalyzer extends base_1.BaseAnalyzer {
analyze(params, fullReport) {
const allSecurityGroups = params.security_groups;
if (!allSecurityGroups) {
return undefined;
}
const mysql_db_port_open_to_world = { type: types_1.CheckAnalysisType.Security };
mysql_db_port_open_to_world.what = "Is MySQL port open to world?";
mysql_db_port_open_to_world.why = "We should always restrict MySQL port only intended parties to access";
mysql_db_port_open_to_world.recommendation = `Recommended to restrict MySQL
port in security groups to specific IPs`;
mysql_db_port_open_to_world.benchmark = ['all', 'hipaa'];
const allRegionsAnalysis = {};
for (const region in allSecurityGroups) {
const regionSecurityGroups = allSecurityGroups[region];
allRegionsAnalysis[region] = [];
for (const securityGroup of regionSecurityGroups) {
if (securityGroup.GroupName === "default") {
continue;
}
const securityGroupAnalysis = {};
securityGroupAnalysis.resource = securityGroup;
securityGroupAnalysis.resourceSummary = {
name: "SecurityGroup",
value: `${securityGroup.GroupName} | ${securityGroup.GroupId}`,
};
if (this.isMySQLOpenToWorld(securityGroup)) {
securityGroupAnalysis.severity = types_1.SeverityStatus.Failure;
securityGroupAnalysis.message = "MySQL Port is open to entire world";
securityGroupAnalysis.action = "Restrict MySQL port";
}
else {
securityGroupAnalysis.severity = types_1.SeverityStatus.Good;
securityGroupAnalysis.message = "MySQL port is not open to entire world";
}
allRegionsAnalysis[region].push(securityGroupAnalysis);
}
}
mysql_db_port_open_to_world.regions = allRegionsAnalysis;
return { mysql_db_port_open_to_world };
}
isMySQLOpenToWorld(securityGroup) {
if (!securityGroup) {
return false;
}
return securityGroup.IpPermissions.some((rule) => {
return rule.FromPort === 3306 && rule.IpRanges.some((ipRange) => {
return ipRange.CidrIp === "0.0.0.0/0";
});
});
}
}
exports.MySQLPortOpenToWorldAnalyzer = MySQLPortOpenToWorldAnalyzer;