DB Security Group With Public Scope
- Query id: 9564406d-e761-4e61-b8d7-5926e3ab8e79
- Query name: DB Security Group With Public Scope
- Platform: CloudFormation
- Severity: High
- Category: Networking and Firewall
- URL: Github
Description¶
The IP address in a DB Security Group should not be '0.0.0.0/0' (IPv4) or '::/0' (IPv6). If so, any IP can access it
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - yaml file
Resources:
DBEC2SecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Open database for access
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 0.0.0.0/0
SecurityGroupEgress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 0.0.0.0/0
DBInstance:
Type: AWS::RDS::DBInstance
Properties:
PubliclyAccessible: true
DBName:
Ref: DBName
Engine: MySQL
MultiAZ:
Ref: MultiAZDatabase
MasterUsername:
Ref: DBUser
DBInstanceClass:
Ref: DBClass
AllocatedStorage:
Ref: DBAllocatedStorage
MasterUserPassword:
Ref: DBPassword
VPCSecurityGroups:
- !GetAtt DBEC2SecurityGroup.GroupId
Postitive test num. 2 - yaml file
Resources:
DBinstance2:
Type: AWS::RDS::DBInstance
Properties:
PubliclyAccessible: true
DBSecurityGroups:
-
Ref: "DbSecurityByEC2SecurityGroup"
AllocatedStorage: "5"
DBInstanceClass: "db.t3.small"
Engine: "MySQL"
MasterUsername: "YourName"
MasterUserPassword: "YourPassword"
DeletionPolicy: "Snapshot"
DbSecurityByEC2SecurityGroup:
Type: AWS::RDS::DBSecurityGroup
Properties:
GroupDescription: "Ingress for Amazon EC2 security group"
DBSecurityGroupIngress:
-
CIDRIP: 0.0.0.0/0
Postitive test num. 3 - yaml file
Resources:
DBEC2SecurityGroup2:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Open database for access
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIpv6: ::/0
SecurityGroupEgress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 0.0.0.0/0
DBInstance3:
Type: AWS::RDS::DBInstance
Properties:
PubliclyAccessible: true
DBName:
Ref: DBName
Engine: MySQL
MultiAZ:
Ref: MultiAZDatabase
MasterUsername:
Ref: DBUser
DBInstanceClass:
Ref: DBClass
AllocatedStorage:
Ref: DBAllocatedStorage
MasterUserPassword:
Ref: DBPassword
VPCSecurityGroups:
- !GetAtt DBEC2SecurityGroup2.GroupId
Postitive test num. 4 - json file
{
"Resources": {
"DBEC2SecurityGroup": {
"Properties": {
"GroupDescription": "Open database for access",
"SecurityGroupIngress": [
{
"IpProtocol": "tcp",
"FromPort": 80,
"ToPort": 80,
"CidrIp": "0.0.0.0/0"
}
],
"SecurityGroupEgress": [
{
"IpProtocol": "tcp",
"FromPort": 80,
"ToPort": 80,
"CidrIp": "0.0.0.0/0"
}
]
},
"Type": "AWS::EC2::SecurityGroup"
},
"DBInstance": {
"Type": "AWS::RDS::DBInstance",
"Properties": {
"PubliclyAccessible": true,
"Engine": "MySQL",
"MasterUsername": {
"Ref": "DBUser"
},
"VPCSecurityGroups": [
"DBEC2SecurityGroup.GroupId"
],
"DBName": {
"Ref": "DBName"
},
"MultiAZ": {
"Ref": "MultiAZDatabase"
},
"DBInstanceClass": {
"Ref": "DBClass"
},
"AllocatedStorage": {
"Ref": "DBAllocatedStorage"
},
"MasterUserPassword": {
"Ref": "DBPassword"
}
}
}
}
}
Postitive test num. 5 - json file
{
"Resources": {
"DBinstance2": {
"Type": "AWS::RDS::DBInstance",
"Properties": {
"PubliclyAccessible": true,
"DBSecurityGroups": [
{
"Ref": "DbSecurityByEC2SecurityGroup"
}
],
"AllocatedStorage": "5",
"DBInstanceClass": "db.t3.small",
"Engine": "MySQL",
"MasterUsername": "YourName",
"MasterUserPassword": "YourPassword"
},
"DeletionPolicy": "Snapshot"
},
"DbSecurityByEC2SecurityGroup": {
"Type": "AWS::RDS::DBSecurityGroup",
"Properties": {
"GroupDescription": "Ingress for Amazon EC2 security group",
"DBSecurityGroupIngress": [
{
"CIDRIP": "0.0.0.0/0"
}
]
}
}
}
}
Postitive test num. 6 - json file
{
"Resources": {
"DBEC2SecurityGroup2": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"SecurityGroupEgress": [
{
"IpProtocol": "tcp",
"FromPort": 80,
"ToPort": 80,
"CidrIp": "0.0.0.0/0"
}
],
"GroupDescription": "Open database for access",
"SecurityGroupIngress": [
{
"CidrIpv6": "::/0",
"IpProtocol": "tcp",
"FromPort": 80,
"ToPort": 80
}
]
}
},
"DBInstance3": {
"Properties": {
"Engine": "MySQL",
"AllocatedStorage": {
"Ref": "DBAllocatedStorage"
},
"MasterUserPassword": {
"Ref": "DBPassword"
},
"VPCSecurityGroups": [
"DBEC2SecurityGroup2.GroupId"
],
"PubliclyAccessible": true,
"DBName": {
"Ref": "DBName"
},
"MultiAZ": {
"Ref": "MultiAZDatabase"
},
"MasterUsername": {
"Ref": "DBUser"
},
"DBInstanceClass": {
"Ref": "DBClass"
}
},
"Type": "AWS::RDS::DBInstance"
}
}
}
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
#this code is a correct code for which the query should not find any result
Resources:
DBEC2SecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Open database for access
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 1.2.3.4/24
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIpv6: 2001:0db8:85a3:0000:0000:8a2e:0370:7334
SecurityGroupEgress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 0.0.0.0/0
DBInstance:
Type: AWS::RDS::DBInstance
Properties:
PubliclyAccessible: true
DBName:
Ref: DBName
Engine: MySQL
MultiAZ:
Ref: MultiAZDatabase
MasterUsername:
Ref: DBUser
DBInstanceClass:
Ref: DBClass
AllocatedStorage:
Ref: DBAllocatedStorage
MasterUserPassword:
Ref: DBPassword
VPCSecurityGroups:
- !GetAtt DBEC2SecurityGroup.GroupId
Negative test num. 2 - yaml file
Resources:
DBinstance:
Type: AWS::RDS::DBInstance
Properties:
PubliclyAccessible: true
DBSecurityGroups:
-
Ref: "DbSecurityByEC2SecurityGroup"
AllocatedStorage: "5"
DBInstanceClass: "db.t3.small"
Engine: "MySQL"
MasterUsername: "YourName"
MasterUserPassword: "YourPassword"
DeletionPolicy: "Snapshot"
DbSecurityByEC2SecurityGroup:
Type: AWS::RDS::DBSecurityGroup
Properties:
GroupDescription: "Ingress for Amazon EC2 security group"
DBSecurityGroupIngress:
-
CIDRIP: 1.2.3.4/24
Negative test num. 3 - json file
{
"Resources": {
"DBEC2SecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"SecurityGroupIngress": [
{
"CidrIp": "1.2.3.4/24",
"IpProtocol": "tcp",
"FromPort": 80,
"ToPort": 80
},
{
"IpProtocol": "tcp",
"FromPort": 80,
"ToPort": 80,
"CidrIpv6": "2001:0db8:85a3:0000:0000:8a2e:0370:7334"
}
],
"SecurityGroupEgress": [
{
"IpProtocol": "tcp",
"FromPort": 80,
"ToPort": 80,
"CidrIp": "0.0.0.0/0"
}
],
"GroupDescription": "Open database for access"
}
},
"DBInstance": {
"Type": "AWS::RDS::DBInstance",
"Properties": {
"PubliclyAccessible": true,
"DBName": {
"Ref": "DBName"
},
"MultiAZ": {
"Ref": "MultiAZDatabase"
},
"MasterUsername": {
"Ref": "DBUser"
},
"AllocatedStorage": {
"Ref": "DBAllocatedStorage"
},
"Engine": "MySQL",
"DBInstanceClass": {
"Ref": "DBClass"
},
"MasterUserPassword": {
"Ref": "DBPassword"
},
"VPCSecurityGroups": [
"DBEC2SecurityGroup.GroupId"
]
}
}
}
}
Negative test num. 4 - json file
{
"Resources": {
"DBinstance": {
"Type": "AWS::RDS::DBInstance",
"Properties": {
"AllocatedStorage": "5",
"DBInstanceClass": "db.t3.small",
"Engine": "MySQL",
"MasterUsername": "YourName",
"MasterUserPassword": "YourPassword",
"PubliclyAccessible": true,
"DBSecurityGroups": [
{
"Ref": "DbSecurityByEC2SecurityGroup"
}
]
},
"DeletionPolicy": "Snapshot"
},
"DbSecurityByEC2SecurityGroup": {
"Type": "AWS::RDS::DBSecurityGroup",
"Properties": {
"GroupDescription": "Ingress for Amazon EC2 security group",
"DBSecurityGroupIngress": [
{
"CIDRIP": "1.2.3.4/24"
}
]
}
}
}
}