Link is throwing 403 – Forbidden

Helpful, but I’m curious if there is a Microsoft expert to assist me with this…and other things.

Hello @Ariella Darlington , to get support via phone/email and get hands on support via remote session, please raise a support request.

For your privacy, please do not share any Personal Identifiable Information (PII) such as your contact information here. Thanks!

Hello @Anji Keesari ,

403 code is directly served by the Application gateway when the Application Gateway WAF detects malicious traffic and blocks it. This behavior is correct and do not have any security risk.

Regards,
Gita

Allow me to jump in Gita and explain.

Our PEN Testing company raised an issue when the WAF returned a 403 error, citing that it pointed towards a response that confirmed a hacker may conclude this is a route to target. I think this is an entirely fair assessment on their part.
Hackers seek vulnerabilities. Getting a 403 is a common method to probe a deeper attack.
Appreciate you at the Mighty Microsoft, but are you saying that Microsoft have no issue or concern here, and thus we can just refer the PEN testers and any future clients who raise concerns to you here?
Ali Khan

Hello @Ali Khan ,

I believed that the question asked by @Anji Keesari was "Is the WAF responding with 403 error, a correct behavior?". The answer to that question is yes, if the WAF detects malicious traffic, then it will block it with a 403 error. This is by design.
Refer : https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview#waf-modes

Now, I'm not aware of the exact scenario of the pen test results. What was the report? Is the error 403 itself is flagged as a vulnerability? Or it is exposing some server field/header in the error which is causing the vulnerability.

From my past working experience, I have seen customers reporting that the error exposes some server headers which are causing vulnerabilities for them.
For e.g. : https://learn.microsoft.com/en-us/answers/questions/627494/index.html

App gateway v2 allows you to rewrite selected content of requests and responses with some limitations, which helps in such cases.
Refer : https://learn.microsoft.com/en-us/azure/application-gateway/rewrite-http-headers-url
https://learn.microsoft.com/en-us/azure/application-gateway/rewrite-http-headers-url#limitations

I would need more details on your pen test reports to further comment on this issue.
Could you please share the exact pen test report/vulnerability?

Regards,
Gita

Hello, Gita

Thanks for your response. Very helpful.
The short answer to your question is that we don't expose any field/headers.

The issue the pen testers outline is simply that the 403 response itself should be neutralised to provide no clue to the user that there is something vulnerable to attack.
This is a fair request.

So it's the message itself that is the issue. Does this make sense?

Ali

Hello @Ali Khan ,

Thank you for the update.

In this case, my suggestion is to configure a custom error page for the 403 WAF error.
You can configure a custom error page for a 403 web application firewall error or a 502 maintenance page.

Custom error pages can be defined at the global level and the listener level:

• Global level - the error page applies to traffic for all the web applications deployed on that application gateway.
• Listener level - the error page is applied to traffic received on that listener.
• Both - the custom error page defined at the listener level overrides the one set at global level.

You must also specify a publicly accessible blob URL for the given error status code.

Refer : https://learn.microsoft.com/en-us/azure/application-gateway/configuration-listeners#custom-error-pages
https://learn.microsoft.com/en-us/azure/application-gateway/custom-error

Kindly let us know if the above helps or you need further assistance on this issue.

Regards,
Gita