Default VPC Network In Use

ID: gcloud-default-vpc-in-use

Severity: medium

Author: princechaddha

Tags: cloud,devops,gcp,gcloud,google-cloud-vpc,networking,security,gcp-cloud-config

Description

Ensure that your Google Cloud Platform (GCP) projects are not using the default Virtual Private Cloud (VPC) network. Using the default VPC network does not adhere to security best practices and may not meet specific networking requirements.

YAML Source

id: gcloud-default-vpc-in-use

info:
  name: Default VPC Network In Use
  author: princechaddha
  severity: medium
  description: |
    Ensure that your Google Cloud Platform (GCP) projects are not using the default Virtual Private Cloud (VPC) network. Using the default VPC network does not adhere to security best practices and may not meet specific networking requirements.
  impact: |
    Using the default VPC network can expose your infrastructure to security risks due to overly permissive rules and configurations.
  remediation: |
    Delete the default VPC network and create custom VPC networks with tailored configurations to meet your organization's security and networking requirements.
  reference:
    - https://cloud.google.com/vpc/docs/vpc
  tags: cloud,devops,gcp,gcloud,google-cloud-vpc,networking,security,gcp-cloud-config

flow: |
  code(1)
  for(let projectId of iterate(template.projectIds)){
    set("projectId", projectId)
    code(2)
  }

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      gcloud projects list --format="json(projectId)"

    extractors:
      - type: json
        name: projectIds
        internal: true
        json:
          - '.[].projectId'

  - engine:
      - sh
      - bash
    source: |
      gcloud compute networks list --project $projectId --format="json(name)"

    matchers:
      - type: word
        words:
          - 'default'

    extractors:
      - type: dsl
        dsl:
          - '"The default VPC network is in use in project " + projectId'
# digest: 4b0a00483046022100ab535503a862d00ef6624bb1eb9dcf10f41a12512e62037044333ae5d539fafc022100e5d94c98878e32663b7a4da7abe3150a742fbf9226ae4af273d4282c11353910:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "cloud/gcp/vpc/gcloud-default-vpc-in-use.yaml"

View on Github