Skip to main content

Unrestricted RPC Access Should Not Be Allowed

More Info:​

No security group should allow unrestricted inbound access to TCP port 135 (RPC).

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Startup Security Baseline
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • FedRAMP
  • GDPR
  • HITRUST CSF
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the issue of unrestricted RPC access in AWS, you can follow these steps:

  1. Open the AWS Management Console and go to the EC2 dashboard.
  2. Click on the "Security Groups" option in the left-hand menu.
  3. Select the security group that is allowing unrestricted RPC access.
  4. Click on the "Inbound Rules" tab and locate the rule that allows RPC access.
  5. Click on the "Edit" button next to the rule.
  6. Change the source IP address to a specific IP address or range of IP addresses that require access to RPC.
  7. If necessary, add a new rule to allow access to RPC from specific IP addresses or ranges.
  8. Click on the "Save" button to apply the changes.

Once the changes are saved, the security group will no longer allow unrestricted RPC access. It is important to regularly review and update security group rules to ensure that they are properly configured and do not leave any vulnerabilities open to attack.

Using CLI

To remediate the "Unrestricted RPC Access Should Not Be Allowed" misconfiguration in AWS using AWS CLI, follow these steps:

  1. Open the AWS CLI on your local machine.

  2. Run the following command to list the security groups in your AWS account:

    aws ec2 describe-security-groups

  3. Identify the security group that has the unrestricted RPC access.

  4. Run the following command to modify the security group and remove the unrestricted RPC access:

    aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol tcp --port 111 --cidr 0.0.0.0/0

    Note: Replace <security-group-id> with the ID of the security group that has the unrestricted RPC access.

  5. Run the following command to verify that the unrestricted RPC access has been removed:

    aws ec2 describe-security-groups --group-ids <security-group-id>

    Note: Replace <security-group-id> with the ID of the security group that has the unrestricted RPC access.

  6. Verify that the remediation was successful by confirming that the security group no longer has unrestricted RPC access.

By following these steps, you can remediate the "Unrestricted RPC Access Should Not Be Allowed" misconfiguration in AWS using AWS CLI.

Using Python

To remediate the "Unrestricted RPC Access Should Not Be Allowed" issue in AWS using Python, follow the below steps:

  1. First, we need to identify the security group that allows unrestricted RPC access. You can use the following Python code to list all the security groups in your AWS account:
import boto3

ec2 = boto3.client('ec2')

response = ec2.describe_security_groups()
for sg in response['SecurityGroups']:
    print(sg['GroupId'], sg['GroupName'])
  1. Once you have identified the security group that allows unrestricted RPC access, you can use the following Python code to revoke the rule:
import boto3

ec2 = boto3.client('ec2')

response = ec2.revoke_security_group_ingress(
    GroupId='SECURITY_GROUP_ID',
    IpPermissions=[
        {
            'IpProtocol': 'tcp',
            'FromPort': 135,
            'ToPort': 139,
            'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
        },
        {
            'IpProtocol': 'tcp',
            'FromPort': 445,
            'ToPort': 445,
            'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
        },
        {
            'IpProtocol': 'udp',
            'FromPort': 137,
            'ToPort': 138,
            'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
        }
    ]
)

In the above code, replace 'SECURITY_GROUP_ID' with the ID of the security group that allows unrestricted RPC access.

  1. The above code will revoke the rule that allows unrestricted RPC access. You can run the first code again to verify that the rule has been revoked.

Note: The above code assumes that you have the necessary permissions to modify security groups in your AWS account.

Using Terraform
resource "aws_security_group" "RPC_SG" {
  name        = "rpc-sg"
  description = "Example SG without unrestricted RPC (TCP 135) access"
  vpc_id      = AWS_VPC_ID  # replace with your VPC ID

  # REMOVE any ingress blocks that:
  # - use protocol "tcp"
  # - have from_port = 135 and to_port = 135
  # - and allow cidr_blocks = ["0.0.0.0/0"] or ipv6_cidr_blocks = ["::/0"]

  # Example of a more restricted rule (only if truly needed):
  # ingress {
  #   description = "RPC from a limited CIDR range"
  #   from_port   = 135
  #   to_port     = 135
  #   protocol    = "tcp"
  #   cidr_blocks = ["ALLOWED_IPV4_CIDR"]  # replace with a specific CIDR, e.g. "10.0.0.0/16"
  # }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  tags = {
    Name = "RPC SG without unrestricted TCP 135"
  }
}

If you manage rules with standalone resources (recommended with current AWS provider), delete the offending resources instead of changing the security group itself:

# DELETE any resources like this that allow 0.0.0.0/0 on TCP 135
resource "aws_vpc_security_group_ingress_rule" "UNRESTRICTED_RPC_IPV4" {
  security_group_id = AWS_SECURITY_GROUP_ID   # replace with your SG ID
  from_port         = 135
  to_port           = 135
  ip_protocol       = "tcp"
  cidr_ipv4         = "0.0.0.0/0"
}

# DELETE any resources like this that allow ::/0 on TCP 135
resource "aws_vpc_security_group_ingress_rule" "UNRESTRICTED_RPC_IPV6" {
  security_group_id = AWS_SECURITY_GROUP_ID   # replace with your SG ID
  from_port         = 135
  to_port           = 135
  ip_protocol       = "tcp"
  cidr_ipv6         = "::/0"
}

This change removes the specific rules allowing unrestricted inbound TCP 135; it does not force replacement of the security group itself, only the individual ingress rules. Be aware this may break any workloads that rely on open RPC from the internet.

For verification, terraform plan should show the offending ingress rule resources being destroyed (- aws_vpc_security_group_ingress_rule.UNRESTRICTED_RPC_IPV4 / UNRESTRICTED_RPC_IPV6) or the corresponding inline ingress blocks being removed from the security group.

Additional Reading:​