Back to Checks
vercel

Vercel project has IP blocking rules configured

security_ip_blocking_rules_configured
Service: securitySeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposedvercel-pro-plan
Resource Type:NotDefined

Vercel projects are assessed for IP blocking rule configuration. IP blocking rules allow denying access from known malicious IP addresses or ranges, reducing the attack surface and preventing traffic from untrusted sources.

Prowler logoProwlerprowler-provider-vercel

Risk

Without IP blocking rules, all traffic is accepted regardless of source IP. Known malicious IPs, abuse networks, and previously identified attackers can freely access the application. This increases the risk of automated scanning, credential stuffing, and targeted attacks from known threat sources.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler vercel --checks security_ip_blocking_rules_configured

Recommendation

Configure IP blocking rules to deny traffic from known malicious sources. Maintain a blocklist of IPs identified through security monitoring, threat intelligence feeds, or incident investigation. Regularly review and update the blocklist.

Remediation

Other

1Sign in to the Vercel dashboard
2Navigate to the project Settings > Security > Firewall
3Add a new IP blocking rule
4Specify the IP addresses or CIDR ranges to block
5Review firewall logs to identify malicious IPs that should be blocked

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportVercel
from prowler.providers.vercel.lib.billing import plan_reason_suffix
from prowler.providers.vercel.services.security.security_client import security_client


class security_ip_blocking_rules_configured(Check):
    """Check if IP blocking rules are configured for each project.

    This class verifies whether each Vercel project has at least one IP
    blocking rule configured to restrict access from known malicious
    IP addresses or ranges.
    """

    def execute(self) -> List[CheckReportVercel]:
        """Execute the Vercel IP Blocking Rules Configuration check.

        Iterates over all firewall configurations and checks if at least
        one IP blocking rule is present.

        Returns:
            List[CheckReportVercel]: A list of reports for each project.
        """
        findings = []
        for config in security_client.firewall_configs.values():
            report = CheckReportVercel(metadata=self.metadata(), resource=config)

            if not config.firewall_config_accessible:
                report.status = "MANUAL"
                report.status_extended = (
                    f"Project {config.project_name} ({config.project_id}) "
                    f"could not be assessed for IP blocking rules because the "
                    f"firewall configuration endpoint was not accessible. "
                    f"Manual verification is required."
                    f"{plan_reason_suffix(config.billing_plan, {'hobby'}, 'IP blocking rules are not available on the Vercel Hobby plan.')}"
                )
            elif config.ip_blocking_rules:
                report.status = "PASS"
                report.status_extended = (
                    f"Project {config.project_name} ({config.project_id}) "
                    f"has {len(config.ip_blocking_rules)} IP blocking rule(s) configured."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Project {config.project_name} ({config.project_id}) "
                    f"does not have any IP blocking rules configured."
                )

            findings.append(report)

        return findings

References