Skip to main content

Unrestricted MsSQL Access Should Not Be Allowed

More Info:​

No security group should allow unrestricted inbound access to TCP port 1433 (MSSQL)

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Startup Security Baseline
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • FedRAMP
  • GDPR
  • HITRUST CSF
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the unrestricted MsSQL access in AWS, you can follow the below steps:

  1. Login to the AWS Management Console.

  2. Go to the RDS dashboard.

  3. Select the RDS instance that has unrestricted MsSQL access.

  4. Click on the "Modify" button.

  5. Scroll down to the "Network & Security" section.

  6. Under the "Security Group Rules" section, click on the "Edit" button.

  7. Remove the rule that allows unrestricted MsSQL access.

  8. Add a new rule that allows MsSQL access only from specific IP addresses or CIDR ranges.

  9. Click on the "Save Changes" button.

  10. Wait for the changes to be applied to the RDS instance.

By following the above steps, you have successfully remediated the unrestricted MsSQL access issue in AWS.

Using CLI

To remediate the unrestricted MsSQL access issue in AWS using AWS CLI, you can follow these steps:

  1. Open the AWS CLI and run the following command to list all the security groups in your AWS account:

    aws ec2 describe-security-groups

  2. Identify the security group that has unrestricted MsSQL access. You can identify the security group by looking at the inbound rules.

  3. Once you have identified the security group, run the following command to revoke the inbound rule that allows unrestricted MsSQL access:

    aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol tcp --port 1433 --cidr 0.0.0.0/0

    Replace <security-group-id> with the ID of the security group that you identified in step 2.

  4. Verify that the inbound rule has been revoked by running the following command:

    aws ec2 describe-security-groups --group-ids <security-group-id>

    Replace <security-group-id> with the ID of the security group that you identified in step 2.

  5. Once you have verified that the inbound rule has been revoked, you have successfully remediated the unrestricted MsSQL access issue in AWS.

Using Python

To remediate this misconfiguration in AWS using Python, you can follow the below steps:

  1. Identify the security group associated with the MS SQL Server instance.

  2. Get the IP address of the client machine from where the MS SQL Server connection is initiated.

  3. Create a new security group rule that allows incoming traffic from the client machine IP address to the MS SQL Server instance on port 1433.

  4. Remove the existing security group rule that allows unrestricted access to the MS SQL Server instance.

Here's the Python code to remediate this misconfiguration:

import boto3

# Specify the region where the MS SQL Server instance is located
region_name = 'us-west-2'

# Specify the name of the security group associated with the MS SQL Server instance
security_group_name = 'ms-sql-sg'

# Specify the IP address of the client machine from where the MS SQL Server connection is initiated
client_ip_address = '10.0.0.1/32'

# Create a new security group rule that allows incoming traffic from the client machine IP address to the MS SQL Server instance on port 1433
ec2 = boto3.client('ec2', region_name=region_name)
response = ec2.authorize_security_group_ingress(
    GroupName=security_group_name,
    IpPermissions=[
        {
            'IpProtocol': 'tcp',
            'FromPort': 1433,
            'ToPort': 1433,
            'IpRanges': [
                {
                    'CidrIp': client_ip_address,
                    'Description': 'Allow MS SQL Server access from client IP address'
                },
            ],
        },
    ],
)

# Remove the existing security group rule that allows unrestricted access to the MS SQL Server instance
response = ec2.revoke_security_group_ingress(
    GroupName=security_group_name,
    IpPermissions=[
        {
            'IpProtocol': 'tcp',
            'FromPort': 1433,
            'ToPort': 1433,
            'IpRanges': [
                {
                    'CidrIp': '0.0.0.0/0',
                },
            ],
        },
    ],
)

Note: Replace the region_name, security_group_name, and client_ip_address variables with the appropriate values for your environment.

Using Terraform
resource "aws_security_group" "mssql_sg" {
  name        = "mssql-sg"
  description = "Security group for MSSQL that does NOT allow unrestricted public access"
  vpc_id      = AWS_VPC_ID  # replace with your VPC ID, e.g. aws_vpc.main.id

  # REMOVE any ingress blocks that allow:
  # - from_port = 1433 / to_port = 1433 / protocol = "tcp"
  #   with cidr_blocks      = ["0.0.0.0/0"]
  #   or ipv6_cidr_blocks   = ["::/0"]

  # Example of a more restrictive replacement (optional):
  ingress {
    description = "MSSQL from trusted IPv4 range"
    from_port   = 1433
    to_port     = 1433
    protocol    = "tcp"
    cidr_blocks = [
      "TRUSTED_IPV4_CIDR", # e.g. "203.0.113.0/24"
    ]
  }

  # Example restrictive IPv6 rule if needed:
  # ingress {
  #   description      = "MSSQL from trusted IPv6 range"
  #   from_port        = 1433
  #   to_port          = 1433
  #   protocol         = "tcp"
  #   ipv6_cidr_blocks = ["TRUSTED_IPV6_CIDR"] # e.g. "2001:db8::/48"
  # }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "mssql-sg"
  }
}

This change is in-place: Terraform will remove the ingress rules on TCP/1433 that use 0.0.0.0/0 and/or ::/0 and, if you add them, create any new restrictive rules without replacing the security group itself.
For verification, terraform plan should show the aws_security_group.mssql_sg resource with the previous ingress blocks for port 1433 and cidr_blocks = ["0.0.0.0/0"] and/or ipv6_cidr_blocks = ["::/0"] being destroyed/changed, and no new rules granting 1433 access to 0.0.0.0/0 or ::/0.

Additional Reading:​