Application gateway WAF can protect all attacks listed(second time)

Question

Application gateway WAF can protect all attacks listed(second time)

Testa 571

Hi,

I asked the same question here(https://learn.microsoft.com/en-us/answers/questions/1112150/application-gateway-waf-can-protect-all-attacks-li.html),
but may I confirm if WAF in Application gateway can protect from the attacks listed below?

Buffer overflow

SSI injection

Directory Traversal (The managed rule in WAF of Front Door mentioned about this)

I cannot find these in the document below.
https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules?tabs=owasp32#crs800-32

ChaitanyaNaykodi-MSFT 27,481 Reputation points Microsoft Employee Moderator

2022-12-15T13:14:42.397+00:00

@Testa
Thank you for reaching out to us and apologies for the inconvenience. Regarding your original question (https://learn.microsoft.com/en-us/answers/questions/1112150/application-gateway-waf-can-protect-all-attacks-li.html) I had posted an update there (screenshot below), just confirming if you were able take a look at it.
Testa 571 Reputation points

2022-12-15T13:32:30.14+00:00

@ChaitanyaNaykodi-MSFT ,

Thanks for your update.

The end user is asking to use WAF, which protects the list of the attacks. In that list, SSI injection and buffer overflow are indicated. We just want to turn Application gateway WAF on and tell the end user that the WAF satisfy all the requirements. Could you please advise if just turning on the WAF in the application gateway cannot protect buffer overflow and SSI injection?

Accepted answer

0 additional answers

Your answer

ChaitanyaNaykodi-MSFT 27,481 Reputation points Microsoft Employee Moderator

2022-12-15T13:14:42.397+00:00

@Testa
Thank you for reaching out to us and apologies for the inconvenience. Regarding your original question (https://learn.microsoft.com/en-us/answers/questions/1112150/application-gateway-waf-can-protect-all-attacks-li.html) I had posted an update there (screenshot below), just confirming if you were able take a look at it.
Testa 571 Reputation points

2022-12-15T13:32:30.14+00:00

@ChaitanyaNaykodi-MSFT ,

Thanks for your update.

The end user is asking to use WAF, which protects the list of the attacks. In that list, SSI injection and buffer overflow are indicated. We just want to turn Application gateway WAF on and tell the end user that the WAF satisfy all the requirements. Could you please advise if just turning on the WAF in the application gateway cannot protect buffer overflow and SSI injection?

Answer 1

David Broggy 6,371 MVP Volunteer Moderator

Hi Taka,

Buffer overflows are best dealt with at the application layer by limiting what is allowed as input.

Azure WAF is good for blocking specific field matches relative to your web site.

That would not include SSI injection as far as I'm aware - again this may be better dealt with at the application layer by limiting input.

I think of Azure waf as a limited set of features built on mod_security (the 'core rule set').

If you want the full power of mod security you could set it up as a separate VM and have much more capabilities, but this requires advanced knowledge of mod_sec.

If you need these sorts of advanced features I personally would consider a more flexible waf solution like F5 or Imperva.

References:
custom-waf-rules-overview
https://en.wikipedia.org/wiki/ModSecurity

Testa 571 Reputation points

2022-12-15T15:10:08.757+00:00

Thank you for your advice, @David Broggy !
David Broggy 6,371 Reputation points MVP Volunteer Moderator

2022-12-15T15:27:36.037+00:00

my pleasure!

Share via

Application gateway WAF can protect all attacks listed(second time)

0 additional answers

Your answer