gcloud-vpc-firewall-port-ranges: Check for VPC Firewall Rules with Port Ranges

id: gcloud-vpc-firewall-port-ranges

info:
  name: Check for VPC Firewall Rules with Port Ranges
  author: princechaddha
  severity: medium
  description: |
    Ensure that your Google Cloud VPC network firewall rules don't have ranges of ports configured to allow inbound traffic. This protects associated virtual machine instances against Denial-of-Service (DoS) attacks or brute-force attacks. It is recommended to open only specific ports within your firewall rules based on your application requirements.
  impact: |
    Allowing a range of ports in firewall rules increases the attack surface, exposing cloud resources to potential attacks.
  remediation: |
    Update your VPC firewall rules to allow only specific ports required for your applications, rather than a range of ports.
  reference:
    - https://cloud.google.com/vpc/docs/firewalls
  tags: cloud,devops,gcp,gcloud,vpc,firewall,security,networking,gcp-cloud-config

flow: |
  code(1)
  for(let projectId of iterate(template.projectIds)){
    set("projectId", projectId)
    code(2)
    for(let networkName of iterate(template.networks)){
      set("networkName", networkName)
      code(3)
      set("firewallRules", template.firewallRules)
      javascript(1)
    }
  }

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      gcloud projects list --format="json(projectId)"

    extractors:
      - type: json
        name: projectIds
        internal: true
        json:
          - '.[].projectId'

  - engine:
      - sh
      - bash
    source: |
      gcloud compute networks list --project $projectId --format="json(name)"

    extractors:
      - type: json
        name: networks
        internal: true
        json:
          - '.[].name'

  - engine:
      - sh
      - bash
    source: |
      gcloud compute firewall-rules list --filter network=$networkName --sort-by priority --format="json(name,disabled,direction,allowed[].ports)"

    extractors:
      - type: json
        name: firewallRules
        internal: true
        json:
          - '.[]'

javascript:
  - code: |
      let firewallRules = template.firewallRules;
            if (typeof firewallRules === "string") {
              firewallRules = JSON.parse(firewallRules); }

      let insecureRules = [];
      for (let rule of firewallRules) {
          if (
              rule.disabled === false &&
              rule.direction === "INGRESS" &&
              Array.isArray(rule.allowed) &&
              rule.allowed.some(allowed =>
                  Array.isArray(allowed.ports) &&
                  allowed.ports.some(port => port.includes("0-") || port.includes("80-8080"))
              )
          ) {
              insecureRules.push(rule.name);
          }
      }

      if (insecureRules.length > 0) {
          Export(`The firewall rules in network ${template.networkName} of project ${template.projectId} allow insecure port ranges for ingress traffic: ${insecureRules.join(", ")}`);
      }

    extractors:
      - type: dsl
        dsl:
          - response
# digest: 4a0a0047304502201cd818761078f4037d69a38657656c26cb8e75a392059cadcebf2ea0fe9e1717022100c11730f4cb93daf0366e3c43a4e465ce5de1a590fa6655c870ab2fc59b4a2115:922c64590222798bb761d5b6d8e72950