EC2 instance does not allow Internet ingress to TCP ports 139 or 445 (CIFS)
ec2_instance_port_cifs_exposed_to_internet
EC2 instances with security groups permitting inbound TCP 139 or 445 (CIFS/SMB) from 0.0.0.0/0 are identified.
Exposure level reflects whether the instance has a public IP and the subnet's Internet reachability.
Risk
Publicly reachable SMB allows unauthorized access and remote code execution, enabling credential theft, NTLM relay, and share enumeration. Attackers can exfiltrate files, tamper or delete data, and spread ransomware, degrading confidentiality, integrity, and availability.
prowler aws --checks ec2_instance_port_cifs_exposed_to_internet
prowler aws --checks ec2_instance_port_cifs_exposed_to_internet --fixer
Recommendation
Restrict CIFS/SMB to trusted internal sources using least privilege; do not allow 0.0.0.0/0.
Adopt defense in depth: place hosts in private subnets, require VPN or controlled jump paths, and enforce segmentation. Disable SMB if unnecessary or use alternatives (e.g., SFTP). Require strong auth and SMB signing.
Remediation
aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":139,"ToPort":139,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]},{"IpProtocol":"tcp","FromPort":445,"ToPort":445,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]}]'
- In AWS Console, go to EC2 > Security Groups
- Select the security group attached to the affected instance
- Edit Inbound rules
- Delete any rule allowing TCP port 139 or 445 from 0.0.0.0/0 or ::/0, or change the source to a specific trusted CIDR
- Save rules
Source Code
Resource Type
AwsEc2Instance