Repository: Checkmarx/kics (language: python)

Issue:
Update Security Groups With Exposed Admin Ports query for CloudFormation
### Platform
CloudFormation

### Provider
AWS

### Query ID 
cdbb0467-2957-4a77-9992-7b55b29df7b7

### Description
Query Security Groups With Exposed Admin Ports should be updated to provide accurate results when specific IP (i.e. 1.2.3.4/32) or specific IP Range is used (192.168.1.0/24).

Here's the CloudFormation Template:

```
AWSTemplateFormatVersion: 2010-09-09
Resources:
  InstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
        GroupDescription: Allow http to client host
        VpcId:
          Ref: myVPC
        SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 11.22.33.44/32
```

### Actual Behavior
```
Security Groups With Exposed Admin Ports, Severity: HIGH, Results: 1
Description: Security Groups should not have ports open in (20, 21, 22, 23, 115, 137, 138, 139, 2049, 3389)
Platform: CloudFormation
Learn more about this vulnerability: https://docs.kics.io/latest/queries/cloudformation-queries/aws/cdbb0467-2957-4a77-9992-7b55b29df7b7

	[1]: testsg.yaml:9

		008:           Ref: myVPC
		009:         SecurityGroupIngress:
		010:         - IpProtocol: tcp
```
### Expected Behavior

This is a false positive. It should only report when 0.0.0.0/0 used for incoming traffic with exposed Admin Ports. 


Discussion / hints:

Fix patch:
diff --git a/assets/queries/cloudFormation/aws/security_groups_with_exhibited_admin_ports/query.rego b/assets/queries/cloudFormation/aws/security_groups_with_exhibited_admin_ports/query.rego
index f853c3bb821..bf482f6ae1f 100644
--- a/assets/queries/cloudFormation/aws/security_groups_with_exhibited_admin_ports/query.rego
+++ b/assets/queries/cloudFormation/aws/security_groups_with_exhibited_admin_ports/query.rego
@@ -8,6 +8,7 @@ CxPolicy[result] {
 	resource := Resources[name]
 	ports := [20, 21, 22, 23, 115, 137, 138, 139, 2049, 3389]
 
+	check_cidrip(resource.Properties)
 	check_security_groups_ingress(resource.Properties, ports)
 
 	result := {
@@ -21,6 +22,10 @@ CxPolicy[result] {
 	}
 }
 
+check_cidrip(group) {
+	group.SecurityGroupIngress[_].CidrIp == "0.0.0.0/0"
+}
+
 check_security_groups_ingress(group, ports) {
 	some p
 	group.SecurityGroupIngress[_].FromPort == ports[p]


Test patch:
diff --git a/assets/queries/cloudFormation/aws/security_groups_with_exhibited_admin_ports/test/negative3.yaml b/assets/queries/cloudFormation/aws/security_groups_with_exhibited_admin_ports/test/negative3.yaml
new file mode 100644
index 00000000000..1e3850a3eee
--- /dev/null
+++ b/assets/queries/cloudFormation/aws/security_groups_with_exhibited_admin_ports/test/negative3.yaml
@@ -0,0 +1,13 @@
+AWSTemplateFormatVersion: 2010-09-09
+Resources:
+  InstanceSecurityGroup:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+        GroupDescription: Allow http to client host
+        VpcId:
+          Ref: myVPC
+        SecurityGroupIngress:
+        - IpProtocol: tcp
+          FromPort: 22
+          ToPort: 22
+          CidrIp: 11.22.33.44/32
\ No newline at end of file