🛡️ Google GCE Network allows unrestricted HTTP traffic🟢
- Contextual name: 🛡️ Google GCE Network allows unrestricted HTTP traffic🟢
- ID:
/ce/ca/google/vpc/network-http-access - Tags:
- Policy Type:
COMPLIANCE_POLICY - Policy Categories:
SECURITY
Logic
Description
Description
This policy identifies Google GCE Networks that have Firewall Rules allowing unrestricted incoming traffic (
0.0.0.0/0) from the internet to the HTTP port 80.In GCP, Firewall Rules are defined at the VPC Network level. Each rule either allows or denies traffic based on its configuration. These configurations specify the type of traffic (e.g., protocols and ports) and the source or destination (e.g., IP addresses, subnets, and instances).
Rationale
While public web servers require accessibility, transmitting traffic over unencrypted HTTP is a security risk. HTTP sends all data in plaintext, making it vulnerable to eavesdropping and man-in-the-middle (MITM) attacks, where an attacker can intercept, read, or modify the communication between users and the server. This can result in the theft of sensitive information such as session cookies, login credentials, or personal data submitted via web forms.
The recommended best practice is to enforce HTTPS for all web traffic to ensure that communications are encrypted.
... see more
Remediation
Remediation
From Google Cloud Console
- Go to
VPC Network.- Go to the
Firewall Rules.- Click the
Firewall Ruleto be modified.- Click
Edit.- Modify
Source IP rangesto specificIP.- Click
Save.From Google Cloud CLI
Identify Firewall Rules Allowing Public Access
gcloud compute networks get-effective-firewalls default \
--format="table(NAME, DIRECTION, IP_RANGES)" \
--filter="IP_RANGES:0.0.0.0/0 AND DIRECTION:INGRESS"Restrict the Source Range
Once you have identified the firewall rules, update each one to restrict access to trusted CIDR ranges:
gcloud compute firewall-rules update {{firewall-rule-name}} \
--source-ranges={{cidr-range1}},{{cidr-range2}}