931130- Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link Exclusions

Question

Hello, Can anyone help me with this.

We enabled WAF rules for my Azure app services and facing one issue with the rule "931130- Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link".

Because of above rule i am getting the issue when we are requesting the below URL.

https://qma-engageidentity.vmmcorp.com/Account/HomeRealm?ReturnUrl=/connect/authorize/callback?response_type=code&client_id=AdminId&redirect_uri=https://qma-admin.vmmcorp.com/&scope=openid

Is this because of having different domains for the requested resource and the redirect uri resource?

We tried disabling the rule "931130- Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link" and it is working fine.

Disabling the rule is the only option we have? If not, Can you suggest the alternatives to fix this show stopper issue.

Thanks in advance.

Answer 1

Hi,

Have you tried adding an exclusion scoped to that specific rule for redirect_uri query string argument? Article below explains in more detail:

Web Application Firewall exclusion lists

https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration?tabs=portal

Additionally, please see GitaraniSharma-MSFT's answer in question below:

https://learn.microsoft.com/en-us/answers/questions/905796/possible-remote-file-inclusion-(rfi)-attack-off-do

If the above answers your question please click Accept Answer. If you are still having an issue please add a comment and I'll assist further.

Thanks.

-TP