Back to Checks
aws

EC2 instance does not allow Internet ingress to TCP ports 139 or 445 (CIFS)

ec2_instance_port_cifs_exposed_to_internet
Service: ec2Severity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2Instance

EC2 instances with security groups permitting inbound TCP 139 or 445 (CIFS/SMB) from 0.0.0.0/0 are identified.

Exposure level reflects whether the instance has a public IP and the subnet's Internet reachability.

Prowler logoProwlerprowler-provider-aws

Risk

Publicly reachable SMB allows unauthorized access and remote code execution, enabling credential theft, NTLM relay, and share enumeration. Attackers can exfiltrate files, tamper or delete data, and spread ransomware, degrading confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_instance_port_cifs_exposed_to_internet

Recommendation

Restrict CIFS/SMB to trusted internal sources using least privilege; do not allow 0.0.0.0/0.

Adopt defense in depth: place hosts in private subnets, require VPN or controlled jump paths, and enforce segmentation. Disable SMB if unnecessary or use alternatives (e.g., SFTP). Require strong auth and SMB signing.

Remediation

CLI

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":139,"ToPort":139,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]},{"IpProtocol":"tcp","FromPort":445,"ToPort":445,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]}]'

Terraform

# Security group without CIFS open to the Internet
resource "aws_security_group" "<example_resource_name>" {
  name   = "<example_resource_name>"
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 139
    to_port     = 139
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # CRITICAL: restrict CIFS (139); do not use 0.0.0.0/0
  }

  ingress {
    from_port   = 445
    to_port     = 445
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # CRITICAL: restrict CIFS (445); do not use 0.0.0.0/0
  }
}

NativeIaC

# CloudFormation: Security group without CIFS open to the Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: SG without CIFS open to Internet
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 139
          ToPort: 139
          CidrIp: 10.0.0.0/8  # CRITICAL: restrict CIFS (139) to a non-Internet CIDR to avoid 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 445
          ToPort: 445
          CidrIp: 10.0.0.0/8  # CRITICAL: restrict CIFS (445) to a non-Internet CIDR to avoid 0.0.0.0/0

Other

1In AWS Console, go to EC2 > Security Groups
2Select the security group attached to the affected instance
3Edit Inbound rules
4Delete any rule allowing TCP port 139 or 445 from 0.0.0.0/0 or ::/0, or change the source to a specific trusted CIDR
5Save rules

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ec2.lib.instance import get_instance_public_status
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class ec2_instance_port_cifs_exposed_to_internet(Check):
    # EC2 Instances with CIFS ports open to the Internet will be flagged as FAIL with a severity of medium if the instance has no public IP, high if the instance has a public IP but is in a private subnet, and critical if the instance has a public IP and is in a public subnet.
    def execute(self):
        findings = []
        check_ports = [139, 445]
        for instance in ec2_client.instances:
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = (
                f"Instance {instance.id} does not have CIFS ports open to the Internet."
            )
            is_open_port = False
            if instance.security_groups:
                for sg in ec2_client.security_groups.values():
                    if sg.id in instance.security_groups:
                        for ingress_rule in sg.ingress_rules:
                            if check_security_group(
                                ingress_rule, "tcp", check_ports, any_address=True
                            ):
                                # The port is open, now check if the instance is in a public subnet with a public IP
                                report.status = "FAIL"
                                (
                                    report.status_extended,
                                    report.check_metadata.Severity,
                                ) = get_instance_public_status(
                                    vpc_client.vpc_subnets, instance, "CIFS"
                                )
                                is_open_port = True
                                break
                        if is_open_port:
                            break
            findings.append(report)
        return findings

References