Azure Web Application Firewall
An Azure service that provides protection for web apps.
302 questions
Apologies, edited this to reply to the above comment
FrontdoorWebApplicationFirewallLog query output
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(124.80000000000001, 23%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMT%3C/text%3E%3C/svg%3E)
Mike Totton
1
Reputation point
Hi,
I notice when querying blocks by the DefaultRuleSet in the WAF there is a restriction in size to the output of certain fields. Most importantly the "matchVariableValue" within the "details_m,atches_s" section. As an example, the full classic test script 'lorem ipsum' (483 words) could be submitted to an application as user input and blocked but on querying the block, would only show the first 15 words (100 chars approx) within the matchVariableValue.
Is there a way to increase the output of this field within the query?
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(134.4, 59%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
ChaitanyaNaykodi-MSFT 24,681 Reputation points Microsoft Employee2021-11-25T00:58:27.377+00:00 Hello @Mike Totton , Thank you for reaching out. As per the documentation here matchVariableValue variable contains the values that triggered the match. If you go through this example here in the documentation the
matchVariableValueis1:1as this value triggered a match and then the request was blocked. Now from your scenario above, can you please explain why thematchVariableValueshould contain all the 483 words from your lorem ipsum? Can you please share if any custom rule was set to match this request? Thank you! -
Mike Totton 1 Reputation point
2021-11-25T17:51:53.967+00:00 Thanks for your response.
For clarity, I am not specifically looking for the matchVariableValue to include all 483 words, just enough so that i can find the characters of user input that trigger a block.
The issue is that the matchVariableValue is concatenated so makes it difficult sometimes to see what exactly has triggered the block, which is important when considering if the block is a false positive. The example i provided does actually get blocked by the RCE-932105 rule. Obviously 'lorem ipsum' is not nefarious input so it is a potential false positive suitable for applying an exclusion. To establish the reason why i have to examine the matchVariableValue, which is limited by concatenation. This is relevant as when i found out what triggered it, it turned out to be the word 'sed' in the lorem ipsum submission, but this was not in the displayed matchVariableValue output, but in text that wasn't shown.
The real issue here is that it may be possible for an attacker to submit apparent benign traffic , that will be captured via matchVariableValue, but append genuine malicious strings after the concatenated capture. This could result in the setting of an exclusion for wrong reasons and opening up a gap in the firewall for exploitation.So, Is there a way to increase the output of the matchVariableValue within a query?
Sign in to comment