WAF: Managed Rule Set Exception for JSON Body

metalheart 366

I am getting several MS managed rule violations from WAF for a legitimate request that posts JSON data to a web API endpoint:

What is a good approach to add an exclusion for this request? My usual approach with POST form data based on the POST argument name doesn't work here, nor can I filter by the request header/cookie/query string args name:

1 answer

ChaitanyaNaykodi-MSFT 26,111 Reputation points Microsoft Employee

2022-10-24T16:53:41.253+00:00

@metalheart ,
Thank you for reaching out.

If I have understood correctly, the JSON request body in your web request is getting blocked by your WAF. You tried adding the Request body post args name exclusion rule but it did not work.

I think you should be able to exclude above JSON request body by adding a Request body JSON args name instead. You can follow this documentation here to try and add this exclusion rule,

Hope this helps! Please do let me know if this exclusion rule does not work in your case. Thank you!
Please sign in to rate this answer.
metalheart 366 Reputation points

2022-10-25T05:19:32.467+00:00

@ChaitanyaNaykodi-MSFT thanks for pointing me to this documentation - unfortunately I don't see the option Request body JSON args name for match variable:

eventhough I'm using DRS 2.0:

Also, I'd expect the log message to state the offending JSON variable name, but details_matches_s says matchVariableName: "". - or is this not supposed to happen with JSON names?

What am I missing?

ChaitanyaNaykodi-MSFT 26,111 Reputation points Microsoft Employee

2022-10-25T18:27:45.167+00:00

@metalheart ,
Thank you for sharing additional details.

unfortunately I don't see the option Request body JSON args name for match variable:

Let me check internally and see if this is a known issue and I will update you. I am able to see the option in the portal for my WAF though.

Meanwhile as a work around can you please try and add this exclusion using PowerShell. You can use Azure Cloud Shell to execute these commands. You can use RequestBodyJsonArgNames as the variable option (Sample Commands below). Reference document and I will recommend running these commands in your test environment first.

ChaitanyaNaykodi-MSFT 26,111 Reputation points Microsoft Employee

2022-10-25T18:31:39.703+00:00

Reference commands.

$exclusionSelector = New-AzFrontDoorWafManagedRuleExclusionObject -Variable RequestBodyJsonArgNames -Operator StartsWith -Selector 'user' $exclusion = New-AzFrontDoorWafManagedRuleOverrideObject -RuleId '942230' -Exclusion $exclusionSelector $ruleGroupOverride = New-AzFrontDoorWafRuleGroupOverrideObject -RuleGroupName 'SQLI' -ManagedRuleOverride $exclusion $managedRuleSet = New-AzFrontDoorWafManagedRuleObject -Type 'Microsoft_DefaultRuleSet' -Version '2.0' -Action Block -RuleGroupOverride $ruleGroupOverride Update-AzFrontDoorWafPolicy -ResourceGroupName '<RGName>' -Name '<WAFName>' -ManagedRule $managedRuleSet

I'd expect the log message to state the offending JSON variable name, but details_matches_s says matchVariableName: "". - or is this not supposed to happen with JSON names?

As per the table here the matchVariableName should contain a value. Can you please share a sample of JSON data you are sending here?

ChaitanyaNaykodi-MSFT 26,111 Reputation points Microsoft Employee

2022-10-26T02:56:34.76+00:00

@metalheart ,

unfortunately I don't see the option Request body JSON args name for match variable:

I checked internally this is a known issue and the fix will be rolled out soon. The current work around is to use PowerShell commands shared above.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

WAF: Managed Rule Set Exception for JSON Body

1 answer

Your answer