Results of a 3rd party scan

Application Security SSL / TLS
1

A 3rd party did a scan of our public domain and came back with these findings. Do you agree with the findings and what would be an appropriate response?

Note: A Web Application Firewall (WAF) does not do the things a firewall does. The focus of a WAF is on the applications themselves, to provide highly granular and customizable logic for protecting the web application and the data behind the scenes. A web application firewall helps protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet. It typically protects the applications from attacks such as cross-site forgery, cross-site-scripting (XSS), file inclusion, and SQL injection, among others:
• Host: 52.189.66.201; Port: 443 open; Application: nginx ssl/http
• Host: 52.189.66.201; Port 80 open; Application: nginx http
• Host: 216.84.167.24; Port 443 open; Application: nginx ssl/http
• Host: 216.84.167.24; Port 80 open; Application: nginx http
• Host: 199.193.156.131; Port 443 open, version 2.4.18; Application: Apache httpd ssl/http
• Host: 199.193.156.131; Port 80 open, version 2.4.18; Application: Apache httpd http
• Host: 172.67.40.222; Port 80 open; Application: Cloudflare http proxy http
• Host: 172.67.40.222 80; Port 80 open; Application: Cloudflare http proxy http
• Host: 172.67.40.222; Port 443 open; Application: nginx ssl/http
• Host: 172.67.40.222; Port 2082 open; Application: Cloudflare http proxy http
• Host: 172.67.40.222; Port 2083 open; Application: nginx ssl/http
• Host: 172.67.40.222; Port 2087 open; Application: nginx ssl/http
• Host: 172.67.40.222; Port 8443 open; Application: nginx ssl/http
• Host: 162.159.9.134; Port 53 open domain
• Host: 162.159.8.123; Port 53 open domain
• Host: 104.22.77.94; Port 80 open; Application: Cloudflare http proxy http
• Host: 104.22.77.94; Port 8080 open; Application: Cloudflare http proxy http
• Host: 104.22.77.94; Port 443 open; Application: nginx ssl/http
• Host: 104.22.77.94; Port 2082 open; Application: Cloudflare http proxy http
• Host: 104.22.77.94; Port 2083 open; Application: nginx ssl/http
• Host: 104.22.77.94; Port 2086 open; Application: Cloudflare http proxy http
• Host: 104.22.77.94; Port 2087 open; Application: nginx ssl/http
• Host: 104.22.77.94; Port 8443 open; Application: nginx ssl/http
• Host: 104.22.76.94; Port 80 open; Application: Cloudflare http proxy http
• Host: 104.22.76.94; Port 8080 open; Application: Cloudflare http proxy http
• Host: 104.22.76.94; Port 443 open; Application: nginx ssl/http
• Host: 104.22.76.94; Port 2082 open; Application: Cloudflare http proxy http
• Host: 104.22.76.94; Port 2083 open, Application: nginx ssl/http
• Host: 104.22.76.94; Port 2086 open, Application: Cloudflare http proxy http
• Host: 104.22.76.94; Port: 2087 open; Application: nginx ssl/http
• Host: 104.22.76.94 8443; Port: open; Application: nginx ssl/http

2

I am not sure what your question is. These ports are all default ports which Cloudflare supports and that is how the service works.

1 Like
3

If you need to, you can block traffic on ports other than 80 and 443 for Pro, Business, and Enterprise domains via WAF rule id 100015: “Anomaly:Port - Non Standard Port (not 80 or 443)”.

4

Wouldn’t that only apply to a hostname port scan? It looks like they’re scanning the IP addresses for open ports.

1 Like
5

The ports will always be reachable. Only, the firewall could pass the request eventually not on, but the overall question is still not clear to me.

6

This topic was automatically closed after 30 days. New replies are no longer allowed.