IP forwarding is enabled Affecting Compute Engine service in Google
Severity Framework
Snyk CCSS
Rule category
Network / Firewall
Is your enviroment affected by this misconfiguration?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsFrameworks
- Snyk ID SNYK-CC-00394
- credit Snyk Research Team
Description
Instance can be used for packet interception and sending spoofed requests.
How to fix?
Set can_ip_forward attribute to false.
Example Configuration
resource "google_compute_instance" "allowed" {
name = "test394a2"
machine_type = "e2-medium"
zone = "us-central1-a"
tags = ["foo", "bar"]
boot_disk {
initialize_params {
image = "debian-cloud/debian-11"
}
}
can_ip_forward = false
network_interface {
network = "default"
access_config {
// Ephemeral IP
}
}
}