Skip to main content

Automatic information enumeration - Open ports

Need​

Restriction of open ports to only necessary services

Context​

  • Usage of Ruby for building dynamic and object-oriented applications
  • Usage of Socket for real-time communication and event-driven programming

Description​

Non compliant code​

require 'socket'

# Open a range of ports
(1..10000).each do |port|
  begin
    server = TCPServer.new('localhost', port)
    puts "Port #{port} is open."
  rescue Errno::EADDRINUSE
    puts "Port #{port} is already in use."
  end
end

In the Ruby script above, we are opening a large range of ports (from 1 to 10,000) on the local machine. This is done by creating a new TCP server for each port number in the specified range.

This code is vulnerable to automatic information enumeration due to the unnecessarily large range of open ports. An attacker can easily scan these open ports to list the services available on the servers and identify potential points of attack.

The vulnerability lies in the TCPServer.new('localhost', port) line where a new server is created for each port. This line of code opens up each port, making them visible and accessible to potential attackers.

This type of vulnerability is considered a serious security risk because it can provide attackers with valuable information about the system, such as the services running on it and their versions, which can be used to exploit known vulnerabilities in those services.

Steps​

  • Review and analyze the necessity of opening a large range of ports.
  • Identify the specific ports that are required for the application to function properly.
  • Update the code to only open the necessary ports and remove the unnecessary port range.
  • Ensure that the updated code is thoroughly tested to verify that the required ports are still accessible.
  • Consider implementing additional security measures such as IP whitelisting or firewall rules to restrict access to the necessary ports.
  • Regularly review and update the port configuration as needed to minimize the attack surface.

Compliant code​

require 'socket'

# Specify necessary ports
necessary_ports = [80, 443]

necessary_ports.each do |port|
  begin
    server = TCPServer.new('localhost', port)
    puts "Port #{port} is open."
  rescue Errno::EADDRINUSE
    puts "Port #{port} is already in use."
  end
end

The updated code now only opens the ports that are necessary for the application to function properly. In this case, we have specified ports 80 and 443, which are commonly used for HTTP and HTTPS traffic respectively.

This change significantly reduces the attack surface of the application by limiting the number of open ports. It also prevents automatic information enumeration by making it harder for attackers to identify available services on the server.

In addition to this code change, it is recommended to implement additional security measures such as IP whitelisting or firewall rules to further restrict access to the necessary ports. Regularly reviewing and updating the port configuration as needed will also help to maintain the security of the application.

References​

Last updated on