aquasecurity / aquasecurity/cloudsploit

GCP openAllPorts error

Open
#960 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
751
Avg merge
11d 9h
Merged PRs (30d)
3

Description

Hello All,

I am working on validating some policies for an application and have been getting an error on the GCP openAllPorts policy. Here is the output:

'''

$ node ./index.js --config ./config.js --cloud google --json=results.json --collection=collection.json --plugin openAllPorts

_____ _ _ _____ _ _ _
/ ____| | | |/ ____| | | (_) |
| | | | ___ _ _ __| | (___ _ __ | | ___ _| |_
| | | |/ _ \| | | |/ _` |\___ \| '_ \| |/ _ \| | __|
| |____| | (_) | |_| | (_| |____) | |_) | | (_) | | |_
\_____|_|\___/ \__,_|\__,_|_____/| .__/|_|\___/|_|\__|
| |
|_|

CloudSploit by Aqua Security, Ltd.
Cloud security auditing for AWS, Azure, GCP, Oracle, and GitHub

INFO: Using CloudSploit config file: ./config.js
INFO: Skipping AWS pagination mode
INFO: Testing plugin: Open All Ports
INFO: Determining API calls to make...
INFO: Found 1 API calls to make for google plugins
INFO: Collecting metadata. This may take several minutes...
INFO: Metadata collection complete. Analyzing...
INFO: Analysis complete. Scan report to follow...
INFO: Collection file written to collection.json
INFO: JSON file written to results.json

┌──────────────────┬───────────────┬─────────────────────────────────────────────┬─────────┬───────┬──────────────────┬──────────────────────────────────────────────────┐
│ Category │ Plugin │ Description │ Resourc │ Regio │ Status │ Message │
│ │ │ │ e │ n │ │ │
├──────────────────┼───────────────┼─────────────────────────────────────────────┼─────────┼───────┼──────────────────┼──────────────────────────────────────────────────┤
│ VPC Network │ Open All │ Determines if all ports are open to the │ N/A │ globa │ UNKNOWN │ Unable to query for projects: Unable to obtain │
│ │ Ports │ public │ │ l │ │ data │
├──────────────────┼───────────────┼─────────────────────────────────────────────┼─────────┼───────┼──────────────────┼──────────────────────────────────────────────────┤
│ VPC Network │ Open All │ Determines if all ports are open to the │ N/A │ globa │ UNKNOWN │ Unable to query for projects: Unable to obtain │
│ │ Ports │ public │ │ l │ │ data │
└──────────────────┴───────────────┴─────────────────────────────────────────────┴─────────┴───────┴──────────────────┴──────────────────────────────────────────────────┘
INFO: Scan complete
/X/X/X/node_modules/async/dist/async.js:966
if (fn === null) throw new Error("Callback was already called.");
^

Error: Callback was already called.
at /X/X/X/node_modules/async/dist/async.js:966:32
at /X/X/X/node_modules/async/dist/async.js:3685:13
at Timeout._onTimeout (/X/X/X/engine.js:204:45)
at listOnTimeout (node:internal/timers:557:17)
at processTimers (node:internal/timers:500:7)

Node.js v17.0.1

'''

I do not believe this is a connectivity issue, since all other policies I have tested so far are working as expected.

Let me know what you think, or what I should test.

Contributor guide

Open the contributing guide

Research direction

Reproduce the reported command with the GCP openAllPorts plugin and inspect the callback path around engine.js:204, where the stack trace reports that the callback was already called. Trace the metadata collection and policy analysis flow to identify why this plugin produces duplicate completion, then verify the scan finishes without the error and still reports the policy result.

Written by the indexing model from the issue text.

Assessment

Tech stack
gcp, javascript, node.js
Domain
cloud, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.