Description

Detects if the default VPC security group allows unrestricted inbound traffic from any source (0.0.0.0/0). This misconfiguration could expose EC2 instances to unauthorized access from the internet, violating the principle of least privilege and potentially creating entry points for attackers.

Detection Strategy

• Identifies security groups with the name 'default' in the AWS account

• Examines each inbound rule (IpPermissions) in the default security group

• Reports a vulnerability if any inbound rule contains a CIDR range of 0.0.0.0/0, which allows traffic from any source IP address