cloud-report
Version:
Collects and analyzes cloud resources
56 lines (55 loc) • 2.76 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
const types_1 = require("../../../types");
const base_1 = require("../../base");
class SecurityGroupsWidePortRangeAnalyzer extends base_1.BaseAnalyzer {
analyze(params, fullReport) {
const allSecurityGroups = params.security_groups;
if (!allSecurityGroups) {
return undefined;
}
const security_groups_wide_port_range = { type: types_1.CheckAnalysisType.Security };
security_groups_wide_port_range.what = "Are there any security groups with wide range of ports?";
security_groups_wide_port_range.why = `Security group should not expose wide range of
port as it will be valnerable for port scan attacks`;
security_groups_wide_port_range.recommendation = "Recommended to expose only port used by application";
security_groups_wide_port_range.benchmark = ['all'];
const allRegionsAnalysis = {};
for (const region in allSecurityGroups) {
const regionSecurityGroups = allSecurityGroups[region];
allRegionsAnalysis[region] = [];
for (const securityGroup of regionSecurityGroups) {
if (securityGroup.GroupName === "default") {
continue;
}
const securityGroupAnalysis = {};
securityGroupAnalysis.resource = securityGroup;
securityGroupAnalysis.resourceSummary = {
name: "SecurityGroup",
value: `${securityGroup.GroupName} | ${securityGroup.GroupId}`,
};
if (this.containsWidePortRange(securityGroup)) {
securityGroupAnalysis.severity = types_1.SeverityStatus.Failure;
securityGroupAnalysis.message = "Exposes wide port range";
securityGroupAnalysis.action = "Remove rule containing IP protocol: -1";
}
else {
securityGroupAnalysis.severity = types_1.SeverityStatus.Good;
securityGroupAnalysis.message = "Exposes only specific ports";
}
allRegionsAnalysis[region].push(securityGroupAnalysis);
}
}
security_groups_wide_port_range.regions = allRegionsAnalysis;
return { security_groups_wide_port_range };
}
containsWidePortRange(securityGroup) {
if (!securityGroup) {
return false;
}
return securityGroup.IpPermissions.some((rule) => {
return rule.IpProtocol === "-1";
});
}
}
exports.SecurityGroupsWidePortRangeAnalyzer = SecurityGroupsWidePortRangeAnalyzer;