Skip to main content

Automatic information enumeration - Open ports

Need​

Restriction of open ports to only necessary services

Context​

  • Usage of Go 1.16 for building efficient and scalable applications
  • Usage of Gin for building web applications in Go
  • Usage of net/http for creating HTTP servers in a Node.js application

Description​

Non compliant code​

package main

import (
    "github.com/gin-gonic/gin"
    "net/http"
)

func main() {
    r := gin.Default()

    for i := 1; i <= 65535; i++ {
        r.GET("/port"+string(i), func(c *gin.Context) {
            c.String(http.StatusOK, "Port "+string(i)+" is open")
        })
    }

    r.Run() // listen and serve on 0.0.0.0:8080
}

The above Go code is a simple server application that uses the Gin framework. The application is set up to open a large range of ports (from 1 to 65535), each with a corresponding GET endpoint. This is done by looping over the range of port numbers and for each one, setting up a GET route that responds with a message indicating that the port is open.

This code is vulnerable to automatic information enumeration because it opens a large number of ports unnecessarily. An attacker can easily scan all the ports to find out which services are available on the server. This information can then be used to exploit known vulnerabilities in those services, or to gain unauthorized access to the system.

A more secure approach would be to only open the ports that are necessary for the application to function, and to use firewalls or other security measures to block access to all other ports. This would limit the amount of information that an attacker can gather about the system, and would reduce the attack surface of the application.

Steps​

  • Review and update the security group configuration to only allow necessary ports to be open.
  • Avoid exposing unnecessary services or ports to the public network.
  • Implement proper access controls and authentication mechanisms to restrict access to sensitive resources.
  • Regularly scan and monitor the network for open ports and vulnerabilities.
  • Consider using a firewall or network security solution to further protect the application and infrastructure.
  • Follow security best practices and guidelines provided by the framework and hosting environment.

Compliant code​

package main

import (
    "github.com/gin-gonic/gin"
    "net/http"
)

func main() {
    r := gin.Default()

    r.GET("/port8080", func(c *gin.Context) {
        c.String(http.StatusOK, "Port 8080 is open")
    })

    r.Run() // listen and serve on 0.0.0.0:8080
}

The original code was opening all ports from 1 to 65535, which is a serious security vulnerability as it exposes all these ports to potential attacks. The revised code only opens port 8080, which is the port the application is running on.

This change significantly reduces the attack surface of the application by limiting the number of open ports. It's important to note that only necessary ports should be open, and all other ports should be closed to reduce the risk of attacks.

In addition to this code change, it's recommended to implement proper access controls and authentication mechanisms to restrict access to sensitive resources. Regularly scanning and monitoring the network for open ports and vulnerabilities can also help identify potential security issues.

Consider using a firewall or network security solution to further protect the application and infrastructure. Always follow security best practices and guidelines provided by the framework and hosting environment.

References​

Last updated on