Back to Checks
aws

Security group does not allow ingress from 0.0.0.0/0 or ::/0 to high-risk TCP ports

ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports
Service: ec2Severity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2SecurityGroup

EC2 security groups are assessed for inbound rules that allow Internet sources (0.0.0.0/0 or ::/0) to high-risk TCP ports: 25, 110, 135, 143, 445, 3000, 4333, 5000, 5500, 8080, 8088.

Findings highlight groups exposing any of these ports to the public network.

Prowler logoProwlerprowler-provider-aws

Risk

Public exposure of these ports enables:

  • RCE via SMB/RPC and weak admin consoles (445, 135, 3000, 5000, 8080)
  • Credential theft/data leakage via mail protocols (25, 110, 143)
  • Spam relay on 25 Impacts: confidentiality, integrity, and availability through exploitation and mass scanning.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports

Recommendation

Restrict these ports using least privilege:

  • Deny Internet ingress; allow only trusted CIDRs or private connectivity
  • Place services behind VPN, bastion, or proxies/WAF; prefer private endpoints
  • Disable unnecessary services; require auth and TLS on exposed apps Apply defense in depth with security groups and network ACLs.

Remediation

Terraform

# Terraform: restrict high-risk TCP port from Internet
resource "aws_security_group" "example" {
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # CRITICAL: do not use 0.0.0.0/0 or ::/0; restrict source to non-Internet to pass the check
  }
}

NativeIaC

# CloudFormation: restrict high-risk TCP port from Internet
Resources:
  ExampleSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict high-risk TCP port
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 8080
          ToPort: 8080
          CidrIp: 10.0.0.0/8  # CRITICAL: do not use 0.0.0.0/0 or ::/0; restrict source to non-Internet to pass the check

Other

1In the AWS console, go to EC2 > Network & Security > Security Groups
2Select the security group in the finding and click Inbound rules > Edit inbound rules
3For each high-risk TCP port (25, 110, 135, 143, 445, 3000, 4333, 5000, 5500, 8080, 8088) with Source 0.0.0.0/0 or ::/0, delete the rule or change Source to a specific trusted CIDR (for example, your VPC CIDR)
4Save rules

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import (
    ec2_securitygroup_allow_ingress_from_internet_to_all_ports,
)
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports(Check):
    def execute(self):
        findings = []
        for security_group_arn, security_group in ec2_client.security_groups.items():
            # Check if ignoring flag is set and if the VPC and the SG is in use
            if ec2_client.provider.scan_unused_services or (
                security_group.vpc_id in vpc_client.vpcs
                and vpc_client.vpcs[security_group.vpc_id].in_use
                and len(security_group.network_interfaces) > 0
            ):
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=security_group
                )
                report.resource_details = security_group.name
                report.status = "PASS"
                report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have any high-risk port open to the Internet."
                # only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice
                if not ec2_client.is_failed_check(
                    ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__,
                    security_group_arn,
                ):
                    check_ports = ec2_client.audit_config.get(
                        "ec2_high_risk_ports",
                        [25, 110, 135, 143, 445, 3000, 4333, 5000, 5500, 8080, 8088],
                    )
                    # Loop through every security group's ingress rule and check it
                    open_ports = []
                    for ingress_rule in security_group.ingress_rules:
                        for port in check_ports:
                            if check_security_group(
                                ingress_rule, "tcp", [port], any_address=True
                            ):
                                open_ports.append(port)

                    if open_ports:
                        report.status = "FAIL"
                        open_ports_str = ", ".join(map(str, open_ports))
                        report.status_extended = f"Security group {security_group.name} ({security_group.id}) has the following high-risk ports open to the Internet: {open_ports_str}."
                else:
                    report.status_extended = f"Security group {security_group.name} ({security_group.id}) has all ports open to the Internet and therefore was not checked against high-risk ports."
                findings.append(report)

        return findings

References