Aws Admin Ports Open
Description
Detects AWS EC2 security groups that allow unrestricted inbound access (0.0.0.0/0) to administrative ports. This poses a critical security risk by potentially exposing management interfaces like RDP or SSH to the entire internet, making EC2 instances vulnerable to unauthorized access attempts.
Detection Strategy
• Evaluates each security group's inbound rules (IpPermissions)
• Flags security groups that have port rules (FromPort/ToPort) allowing access from 0.0.0.0/0
• Reports a vulnerability if administrative ports (like 22, 3389, 23) are accessible from any IP address
• Examines both IPv4 (IpRanges) and IPv6 (Ipv6Ranges) permissions for unrestricted access patterns
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' pentesting team, fill out this contact form.