Description

Detects AWS EC2 security groups configured with overly permissive rules that allow all network ports (0-65535) to be accessible. This configuration creates a significant security risk by potentially exposing EC2 instances to unauthorized access across all possible network ports.

Detection Strategy

• Scans all security groups in the specified AWS region

• Identifies inbound rules (IpPermissions) that allow traffic on all ports (from port 0 to port 65535)

• Identifies outbound rules (IpPermissionsEgress) that allow traffic on all ports (from port 0 to port 65535)

• Reports a vulnerability when any security group rule is found allowing all ports (0-65535)