Back to Checks
huaweicloud

VPC security groups do not allow open ingress on sensitive ports

vpc_security_group_open_ingress
Service: vpcSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

Security groups should not allow ingress from 0.0.0.0/0 on sensitive ports such as SSH (22), RDP (3389), MySQL (3306), Redis (6379), and MongoDB (27017). Open ingress on these ports exposes critical services to the internet and significantly increases the attack surface.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

Allowing unrestricted ingress on sensitive ports exposes services like SSH, RDP, and databases to the entire internet. This makes them vulnerable to brute force attacks, credential stuffing, exploitation of known vulnerabilities, and unauthorized access to sensitive data.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks vpc_security_group_open_ingress

Recommendation

Restrict ingress rules on sensitive ports to trusted IP ranges instead of 0.0.0.0/0.

Remediation

CLI

hcloud VPC DeleteSecurityGroupRule --security_group_rule_id=<rule_id>

Other

1Log on to the **Huawei Cloud** console.
2Choose **VPC**.
3Click **Security Groups**.
4Select the **security group**.
5Edit the `ingress` rule with `0.0.0.0/0` on a sensitive port.
6Restrict the source **CIDR** to a trusted IP range.
7Click **OK**.

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.vpc.vpc_client import vpc_client
from prowler.providers.huaweicloud.services.vpc.vpc_service import (
    SENSITIVE_PORTS,
    rule_covers_port,
    rule_source_is_open,
)


class vpc_security_group_open_ingress(Check):
    """Check if VPC security groups allow open ingress on sensitive ports."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        for sg in vpc_client.security_groups.values():
            report = CheckReportHuaweiCloud(metadata=self.metadata(), resource=sg)
            report.region = sg.region
            report.resource_id = sg.id
            report.resource_arn = f"huaweicloud:vpc:{sg.region}:{vpc_client.audited_account}:security-group/{sg.id}"

            open_sensitive_ports = set()
            for rule in sg.rules:
                if rule.direction != "ingress":
                    continue
                if not rule_source_is_open(rule):
                    continue
                for port in SENSITIVE_PORTS:
                    if rule_covers_port(rule, port):
                        open_sensitive_ports.add(port)

            if open_sensitive_ports:
                report.status = "FAIL"
                ports_str = ", ".join(str(p) for p in sorted(open_sensitive_ports))
                report.status_extended = (
                    f"Security group {sg.name} ({sg.id}) allows open ingress "
                    f"on sensitive port(s): {ports_str}."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Security group {sg.name} ({sg.id}) does not allow "
                    "open ingress on sensitive ports."
                )

            findings.append(report)

        return findings

References