Project: KICS (Provisioning / Security & Compliance)
File: 0ac9abbc-6d7a-41cf-af23-2e57ddb3dbfc.md

title: Sensitive Port Is Exposed To Entire Network hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 0ac9abbc-6d7a-41cf-af23-2e57ddb3dbfc Query name: Sensitive Port Is Exposed To Entire Network Platform: Ansible Severity: <span style="color:#bb2124">High</span> Category: Networking and Firewall URL: A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="130 99 69 41 13 142 113 85 55 27" name: foo1 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example1 priority: 100 direction: Inbound access: Allow protocol: UDP sourceportrange: "*" destinationportrange: "61621" sourceaddressprefix: "/0" destinationaddressprefix: "*" name: foo2 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example2 priority: 100 direction: Inbound access: Allow protocol: TCP sourceportrange: "*" destinationportrange: "23-34" sourceaddressprefix: "1.1.1.1/0" destinationaddressprefix: "*" name: foo3 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example3 priority: 100 direction: Inbound access: Allow protocol: "*" sourceportrange: "*" destinationportrange: "21-23" sourceaddressprefix: "/0" destinationaddressprefix: "*" name: foo4 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example4 priority: 100 direction: Inbound access: Allow protocol: "*" sourceportrange: "*" destinationportrange: "23" sourceaddressprefix: "0.0.0.0/0" destinationaddressprefix: "*" name: foo5 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example5 priority: 100 direction: Inbound access: Allow protocol: "UDP" sourceportrange: "*" destinationportrange: "23" "245" sourceaddressprefix: "34.15.11.3/0" destinationaddressprefix: "*" name: foo6 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example6 priority: 100 direction: Inbound access: Allow protocol: "TCP" sourceportrange: "*" destinationportrange: "23" sourceaddressprefix: "/0" destinationaddressprefix: "*" name: foo7 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example7 priority: 100 direction: Inbound access: Allow protocol: "UDP" sourceportrange: "*" destinationportrange: "22-64, 94" sourceaddressprefix: "10.0.0.0/0" destinationaddressprefix: "*" name: foo8 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example8 priority: 100 direction: Inbound access: Allow protocol: "TCP" sourceportrange: "*" destinationportrange: "14" "23" "48" sourceaddressprefix:

destinationaddressprefix: "*" name: foo9 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example9 priority: 100 direction: Inbound access: Allow protocol: "*" sourceportrange: "*" destinationportrange: "12" "23-24" "46" sourceaddressprefix: "/0" destinationaddressprefix: "*" name: example10 priority: 100 direction: Inbound access: Allow protocol: "*" sourceportrange: "*" destinationportrange: 46-146, 18-36, 1-2, 3 sourceaddressprefix: "1.2.3.4/0" destinationaddressprefix: "*" ``` ```yaml title="Negative test num. 1 - yaml file" name: foo1 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example1 priority: 100 direction: Inbound access: Deny protocol: TCP sourceportrange: '*' destinationportrange: 23 sourceaddressprefix: '*' destinationaddressprefix: '*' name: foo2 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example2 priority: 100 direction: Inbound access: Allow protocol: Icmp sourceportrange: '*' destinationportrange: 23-24 sourceaddressprefix: '*' destinationaddressprefix: '*' name: foo3 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example3 priority: 100 direction: Inbound access: Allow protocol: TCP sourceportrange: '*' destinationportrange: 8-174 sourceaddressprefix: 0.0.0.0 destinationaddressprefix: '*' name: foo4 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example4 priority: 100 direction: Inbound access: Allow protocol: TCP sourceportrange: '*' destinationportrange: 23-196 sourceaddressprefix: 192.168.0.0 destinationaddressprefix: '*' name: foo5 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example5 priority: 100 direction: Inbound access: Allow protocol: TCP sourceportrange: '*' destinationportrange: 23 sourceaddressprefix: /1 destinationaddressprefix: '*' name: foo6 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example6 priority: 100 direction: Inbound access: Allow protocol: '*' sourceportrange: '*' destinationportrange: 43 sourceaddressprefix: /0 destinationaddressprefix: '*' name: foo7 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example7 priority: 100 direction: Inbound access: Allow protocol: Icmp sourceportrange: '*' destinationportrange: 23 sourceaddressprefix: internet destinationaddressprefix: '*' name: foo8 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example8 priority: 100 direction: Inbound access: Allow protocol: '*' sourceportrange: '*' destinationportrange: 22, 24,49-67 sourceaddressprefix: any destinationaddressprefix: '*' name: foo9 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example9 priority: 100 direction: Inbound access: Allow protocol: Icmp sourceportrange: '*' destinationportrange: 23 sourceaddressprefix: /0 destinationaddressprefix: '*' name: foo10 azurermsecuritygroup: resource_group: myResourceGroup name: mysecgroup rules: name: example10 priority: 100 direction: Inbound access: Allow protocol: TCP sourceportrange: '*' destinationportrange: 23 69 sourceaddressprefix: 0.0.1.0 destinationaddressprefix: '*' name: example11 priority: 100 direction: Inbound access: Allow protocol: TCP sourceportrange: '*' destinationportrange: 2 310 sourceaddressprefix: 0.0.0.0 destinationaddressprefix: '*' ```