Back to Checks
oraclecloud

Network security group restricts ingress from 0.0.0.0/0 to port 3389 (RDP)

network_security_group_ingress_from_internet_to_rdp_port
Service: networkSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NetworkSecurityGroup

OCI Network Security Groups are evaluated for inbound source 0.0.0.0/0 permitting RDP on TCP 3389, including broad rules (all TCP or any protocol) that implicitly include that port.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Exposed RDP enables Internet-scale brute-force and protocol exploit attempts. Compromise yields interactive access for data exfiltration (C), unauthorized changes (I), and service disruption via ransomware (A), with potential lateral movement across the VCN.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks network_security_group_ingress_from_internet_to_rdp_port

Recommendation

Eliminate open 0.0.0.0/0 rules. Restrict RDP to trusted IPs and only when necessary. Prefer private connectivity via VPN, bastion/jump hosts, or zero-trust brokers. Apply least privilege and time-bound access, monitor logs, and disable RDP where unnecessary.

Remediation

CLI

oci network nsg rules delete --network-security-group-id <NSG_OCID> --security-rule-id <SECURITY_RULE_ID>

Terraform

resource "oci_core_network_security_group_security_rule" "<example_resource_name>" {
  network_security_group_id = "<example_resource_id>"
  direction = "INGRESS"
  protocol  = "6" # TCP
  source    = "10.0.0.0/8" # Critical: not 0.0.0.0/0; restricts RDP to an internal CIDR to remove internet exposure

  tcp_options {
    destination_port_range {
      min = 3389  # Critical: explicit RDP port
      max = 3389  # Critical: ensures only 3389 is allowed
    }
  }
}

Other

1In the OCI Console, go to Networking > Network Security Groups
2Open the <NSG_NAME>
3Click Security Rules, then the Ingress tab
4Find the rule with Source 0.0.0.0/0 and Protocol TCP (or All) allowing port 3389
5Click Delete to remove the rule
6- If RDP is required, Edit instead and set Source to a specific CIDR (not 0.0.0.0/0)
7Save changes

Check Code

"""Check Ensure no network security groups allow ingress from 0.0.0.0/0 to port 3389."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.network.network_client import network_client


class network_security_group_ingress_from_internet_to_rdp_port(Check):
    """Check Ensure no network security groups allow ingress from 0.0.0.0/0 to port 3389."""

    def execute(self) -> Check_Report_OCI:
        """Execute the network_security_group_ingress_from_internet_to_rdp_port check."""
        findings = []

        for nsg in network_client.network_security_groups:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=nsg,
                region=nsg.region,
                resource_name=nsg.display_name,
                resource_id=nsg.id,
                compartment_id=nsg.compartment_id,
            )

            # Check NSG rules for 0.0.0.0/0 to port 3389
            has_rdp_from_internet = False
            for rule in nsg.security_rules:
                if (
                    rule.get("direction") == "INGRESS"
                    and rule.get("source") == "0.0.0.0/0"
                ):
                    protocol = rule.get("protocol")
                    # Protocol 6 is TCP
                    if protocol == "6":
                        tcp_options = rule.get("tcp_options")
                        # If tcp_options is None, all TCP ports are allowed
                        if not tcp_options:
                            has_rdp_from_internet = True
                            break
                        # If tcp_options exists, check destination port range
                        dst_port = tcp_options.get("destination_port_range")
                        if dst_port:
                            port_min = dst_port.get("min", 0)
                            port_max = dst_port.get("max", 0)
                            if port_min <= 3389 <= port_max:
                                has_rdp_from_internet = True
                                break
                        # If no destination port range specified, all ports are allowed
                        else:
                            has_rdp_from_internet = True
                            break
                    # Protocol "all" or if protocol is not specified
                    elif protocol == "all" or not protocol:
                        has_rdp_from_internet = True
                        break

            if has_rdp_from_internet:
                report.status = "FAIL"
                report.status_extended = f"Network security group {nsg.display_name} allows ingress from 0.0.0.0/0 to port 3389 (RDP)."
            else:
                report.status = "PASS"
                report.status_extended = f"Network security group {nsg.display_name} does not ingress from 0.0.0.0/0 to port 3389 (RDP)."

            findings.append(report)

        return findings

References