T09 · Insecure Skill Coding Practices
- Location
SKILL.md:214- Finding
Globally Exposed Plaintext HTTP and Unrestricted Outbound Traffic
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 214–231
Vulnerability Type: Insecure cloud network configuration
Risk Level: MediumVulnerable Code:
hcl ingress { from_port = 80 to_port = 80 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } ingress { from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = ["10.0.0.0/16"] } egress { from_port = 0 to_port = 0 protocol = "-1" }Technical Analysis
The Terraform example exposes the web service to every IPv4 address over unencrypted HTTP. Traffic sent over port 80 lacks transport confidentiality and integrity unless encryption is implemented separately at the application layer.
The security group also permits all outbound protocols and destinations. Although unrestricted egress does not independently compromise the instance, it weakens containment after a web-service compromise by allowing arbitrary command-and-control connections, payload retrieval, or data exfiltration.
These defaults conflict with the Skill's stated principles of encrypted data transmission and least-privilege access. Because the configuration is presented as a foundational AWS architecture example, users may deploy it without sufficient production hardening.
Attack Path
- A user deploys the provided Terraform example.
- The EC2 web service becomes reachable from the public internet on TCP port 80.
- An attacker observes or manipulates plaintext traffic through an applicable network position, or targets a vulnerability in the publicly reachable web service.
- If the instance is compromised, the unrestricted egress rule permits communication with arbitrary external hosts.
- The attacker may retrieve additional payloads, establish command-and-control traffic, or exfiltrate data accessible to the compromised instance.
Impact Assessment
Plaintext HTTP may expose application re ...[truncated 477 chars]
- Remediation
View remediation
Remediation Suggestions
- Terminate TLS through an Application Load Balancer, API Gateway, reverse proxy, or the application itself.
- Permit public access on TCP port 443 and redirect TCP port 80 to HTTPS only when an HTTP redirect is required.
- Configure valid certificates through AWS Certificate Manager or another trusted certificate authority.
- Restrict outbound traffic to the exact protocols, ports, and destinations required by the workload.
- Use VPC endpoints for supported AWS services to reduce unnecessary internet egress.
- Add network monitoring through VPC Flow Logs, GuardDuty, and appropriate egress alerts.
- Clearly label simplified examples as non-production and document the hardening required before deployment.